Escuela Tecnológica Instituto Técnico Central

Tecnólogo en Desarrollo de Software

Asignatura: Bases de Datos II
Estudiantes: Javier Sánchez / José Reinoso

TALLER DE SEGURIDAD SQL SERVER

Restauramos la base de datos AdventureWorld2019 en nuestro SQL Server.

Hacemos auditoría a la base de datos, escaneamos las vulnerabilidades.

Luego de corregir un error, pasamos nuevamente la auditoría.

Exportación de la auditoría realizada a Excel.

Hacemos auditoría a la base de datos master

Ahora, realizamos la auditoría con una base de datos creada en clases pasadas,
en este caso será “BIBLIOTECA”

Una vez solucionados los errores presentados en la auditoría, la realizamos

nuevamente. Observando que, no se encontraron “failing check”
 Anexos
Scripts sugeridos y usados para la corrección de los errores presentados en la
primera auditoría.
Scripts completos:

IF((SELECT count(*) from sys.database_principals WHERE principal_id >= 5 AND

principal_id < 16384 ) > 0) SELECT 0 AS [Violation] 1
ELSE SELECT 1 AS [Violation]

SELECT CASE WHEN EXISTS

( SELECT *
FROM sys.databases
WHERE name = db_name() 2
AND is_encrypted = 0)
THEN 1
ELSE 0
END AS [Violation]

SELECT permission_name AS [Permission]

,schema_name AS [Schema]
,object_name AS [Object]
FROM (
3
SELECT objs.TYPE COLLATE database_default AS object_type
,schema_name(schema_id) COLLATE database_default AS schema_name
,objs.name COLLATE database_default AS object_name
,user_name(grantor_principal_id) COLLATE database_default AS
grantor_principal_name
,permission_name COLLATE database_default AS permission_name
,perms.TYPE COLLATE database_default AS TYPE
,STATE COLLATE database_default AS STATE
FROM sys.database_permissions AS perms
INNER JOIN sys.objects AS objs
ON objs.object_id = perms.major_id
WHERE perms.class = 1 -- objects or columns. Other cases are handled by VA1095
which has different remediation syntax
AND grantee_principal_id = DATABASE_PRINCIPAL_ID('public')
AND [state] IN (
'G'
,'W'
)
AND NOT (
-- These permissions are granted by default to public
permission_name = 'EXECUTE'
AND schema_name(schema_id) = 'dbo'
AND STATE = 'G'
AND objs.name IN (
'fn_sysdac_is_dac_creator'
,'fn_sysdac_is_currentuser_sa'
,'fn_sysdac_is_login_creator'
,'fn_sysdac_get_username'
,'sp_sysdac_ensure_dac_creator'
,'sp_sysdac_add_instance'
,'sp_sysdac_add_history_entry'
,'sp_sysdac_delete_instance'
,'sp_sysdac_upgrade_instance'
,'sp_sysdac_drop_database'
 ,'sp_sysdac_rename_database'
,'sp_sysdac_setreadonly_database'
,'sp_sysdac_rollback_committed_step'
,'sp_sysdac_update_history_entry'
,'sp_sysdac_resolve_pending_entry'
,'sp_sysdac_rollback_pending_object'
,'sp_sysdac_rollback_all_pending_objects'
,'fn_sysdac_get_currentusername'
)
OR permission_name = 'SELECT'
AND schema_name(schema_id) = 'sys'
AND STATE = 'G'
AND objs.name IN (
'firewall_rules'
,'database_firewall_rules'
,'ipv6_database_firewall_rules'
,'bandwidth_usage'
,'database_usage'
,'external_library_setup_errors'
,'sql_feature_restrictions'
,'resource_stats'
,'elastic_pool_resource_stats'
,'dm_database_copies'
,'geo_replication_links'
,'database_error_stats'
,'event_log'
,'database_connection_stats'
)
OR permission_name = 'SELECT'
AND schema_name(schema_id) = 'dbo'
AND STATE = 'G'
AND objs.name IN (
'sysdac_instances_internal'
,'sysdac_history_internal'
,'sysdac_instances'
)
)

) t