Inkey's ability pond: SQL Server–Security Risk Assessment PMP Way

Recently I had a chance to speak my friend Ashish Sharma who is my colleague too. We were discussing Project Management topics (he recently passed PMP and ACP). Our discussion ended at very interesting topic – RISK Assessment.

Definition: According to PMBOK, Projects can have unforeseen event or activity that can impact the project’s progress, result or an outcome in negative or positive way. Further, A Risk can be assessed using two factors – impact and probability. Determining the quantitative or qualitative value of risk related to a concrete situation and recognized threats is known as Risk Assessment.

So, coming to the point, how do we do Risk Assessment for Database systems, especially SQL Server ?

I myself have never come to situation where I have created or used Risk Assessment Register for SQL Server. I was thinking is there some readily available Risk Assessment Register / document somewhere? Hence, I have decided to research little more on it. I found absolutely nothing on this very topic. However, searching for different term - SQL Server security, and Risk Assessment – none found.

After spending some time researching I have found a good sample document for Risk Assessment Register that we can use, you can download it from here.

Now, this is what we have is Risk Register, how about threats? Sometime back, in 2009 I have wrote an article on SQL Server Security, using that article I have tried to pen down some threats that I can think off at this moment, they are:

Possible Threats	Risk Mitigation
Virus Attack	Install AV on DB Server however do not forget to exclude SQL server files
Unauthorised Logins	Always use Audit (C2, Windows, SQL or both) failed login attempts and analyze them regularly. Always, rename SA / Admin account and use strong password mechanism for all the servers. If possible always try to use domain authenticated acconts.
MiM Attack	To metigate MiM attach do following : Isolate database server from Application / IIS Server Configure SQL Server to use non-default port Use Encryption / SSL Use Firewall inbound / outbound rules
Root Access	To avoid someone getting root access do following: Disable / Rename in-built Admin account Grant least access to Service Account Use strong / random password
SQL Injection	Do following: Avoid using Dynamic SQL when you can use parameterized query / stored procedure 3) Always validate the value at form level before it's being passed to database server Refer above items
Known Configuration	Always try to customize default configuration if you can, for example: Run SQL server on non standard port disable / rename SA account Disable xp_cmdshell and other extended procedures