Mastering SQL Server 2000 Security docx

Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Mike Young is the co-founder of Softouch Inc. Mike has spent the last sev- eral years teaching, consulting, and developing training materials about Microsoft products. Mike has spent the majority of his time over the years supporting and consulting about Microsoft SQL Server. He has a back- ground in database administration and is concerned that his clients meet their expectations for the product. Mike’s primary areas of expertise are Data Transformation Services (DTS), Analysis Server, and all areas related to security. Curtis W. Young is the other co-founder of Softouch Inc. Curtis has a deep love for training and education. Curtis’ background is on the program- ming side. He has taught and consulted regarding Visual Basic, Visual Interdev, Visual C++, and Java. Curtis has spent a significant amount of time designing and developing applications that use SQL Server as the back-end database. He receives the most satisfaction from providing sys- tems solutions to business obstacles. About the Authors xxxi Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Mike Young Curtis W.Young Mastering SQL Server  2000 Security Gearhead Press  Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Mastering SQL Server  2000 Security Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Mike Young Curtis W.Young Mastering SQL Server  2000 Security Gearhead Press  Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Publisher: Robert Ipsen Editor: Ben Ryan Consulting Editor: Donis Marshall Managing Editor: Angela Smith New Media Editor: Brian Snapp Text Design & Composition: Wiley Composition Services Designations used by companies to distinguish their products are often claimed as trademarks. In all instances where Wiley Publishing, Inc., is aware of a claim, the product names appear in initial capital or all capital letters. Readers, however, should contact the appropriate companies for more complete information regard- ing trademarks and registration. This book is printed on acid-free paper. ∞ Copyright © 2002 by Mike Young, Curtis Young. All rights reserved. Published by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permis- sion of the Publisher, or authorization through payment of the appropriate per- copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 750-4744. Requests to the Publisher for permission should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspointe Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4447, E-mail: permcoordinator@wiley.com. This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold with the understanding that the publisher is not engaged in professional services. If professional advice or other expert assistance is required, the services of a competent professional person should be sought. The Gearhead Press trademark is the exclusive property of Gearhead Group Corporation. Library of Congress Cataloging-in-Publication Data: ISBN: 0-471-21970-3 Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic versions. For more information about Wiley products, visit our web site at www.wiley.com. Printed in the United States of America. 10 9 8 7 6 5 4 3 2 1 Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com A Note from Gearhead Press Gearhead Press is dedicated to publishing technical books for experienced Information Technology professionals—network engineers, developers, system administrators, and others—who need to update their skills, learn how to use technology more effectively, or simply want a quality reference to the latest technology. Gearhead Press emerged from my experience with professional trainers of engineers and developers: people who truly under- stand first-hand the needs of working professionals. Gearhead Press authors are the crème de la crème of industry trainers, working at the com- panies that define the technology revolution. For this reason, Gearhead Press authors are regularly in the trenches with the developers and engi- neers that have changed the world through innovative products. Drawing from this experience in IT training, our books deliver superior technical content with a unique perspective that is based on real-world experience. Now, as an imprint of Wiley Publishing, Inc., Gearhead Press will con- tinue to bring you, the reader, the level of quality that Wiley has delivered consistently for nearly 200 years. Thank you. Donis Marshall Founder, Gearhead Press Consulting Editor, Wiley Publishing, Inc. Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com [...]... Internet Security Overview of Internet Integration Features of SQL Server 2000 Integration with Other Products SQL Server Engine Enhancements Connections to SQL Server from the Internet A Direct Connection to SQL Server Client Tools A Connection through OLE DB Connections through Firewalls and Proxy Servers Using a Firewall System with SQL Server Connections to SQL Server through a Proxy Server Reverse-Publishing... a Proxy Server Connecting to SQL Server through a Web Server Using Active Data Objects with Active Server Pages Using Java Database Connectivity to Access SQL Server 342 344 344 345 345 347 348 351 352 352 353 355 355 356 359 360 360 361 362 363 364 366 Using the Web Assistant Wizard Best Practices 367 368 Appendix A XML for SQL Server 2000 Introduction to XML and SQL Server Configuring SQL Server Support... for SQL Server 2000 This appendix outlines the role of XML in the storage and retrieval of data with SQL Server 2000 It is provided as an extension to Chapter 15, “Managing Internet Security. ” You will be introduced to the purpose for XML storage and retrieval in SQL Server and the configuration of integration of SQL Server and Internet Information Server to support XML Appendix B: Third-Party SQL Server. .. Introducing SQL Server Security Microsoft SQL Server has continued to grow in market share over the last several years Many factors have contributed to this growth Software development companies have chosen Microsoft SQL Server for their data storage, SQL Server is easy install and to maintain, and SQL Server integrates seamlessly with Internet applications Consequently, organizations are using SQL Server 2000, ... for SQL Server security This information should then be made available to all administrators and developers of SQL Server It is important that all SQL administrative staff work from the same security goals and design Chapter 3: Exploring Initial Security Parameters This chapter outlines the security necessary for installing and configuring SQL Server It also describes the tools supplied with SQL Server. .. 1 Introducing SQL Server Security Security Overview Requirements Analysis The Critical Nature of the Data Auditing Requirements Who Will Administer the Server? Access to SQL Server Windows Authentication SQL Server Authentication Accessing Databases on a SQL Server 2000 Instance Permissions to Objects in a SQL Server Database Object Ownership Object Dependencies Installation Security Installation Permissions... to administering SQL Server security This part outlines the necessary requirements for a solid security design and approach to SQL Server Part II: Security Management Fundamentals This part introduces the basics of SQL Server security The main topics covered include initial installation security issues, creating and managing logins, and managing object permissions For experienced SQL Server users, this... Client /Server Architecture and Terms 175 176 The Client /Server Model Services and Tiers Two-Tier Client /Server Architecture Three-Tier Client /Server Architecture Application Infrastructure Introduction to Security Security in Two-Tier Applications Security in Three-Tier Applications Security in COM+ Multitier Application Security Implementing Security in COM+ Applications Role-Based Security Declarative Security. .. Services Security Concerns Linked Servers Replication Benefits of Replication When to Use Replication Security Concerns with Replication Analysis Services Online Analytical Processing Data Mining Analysis Services Security Auditing SQL Server Auditing Application Auditing Chapter 2 Designing a Successful Security Model Server Architecture The Production Server The Test Server The Development Server Scripts... items: Part I: System Security Design This part provides an overview of the book as well as an introduction into the security design of SQL Server SQL Server security can be easy to implement and support, but it depends on a solid design Many organizations fail to create a security design and the applications that are implemented do not follow a consistent security strategy Inconsistent security approaches . Authentication 5 SQL Server Authentication 6 Accessing Databases on a SQL Server 2000 Instance 7 Permissions to Objects in a SQL Server Database 8 Object Ownership 8 Object Dependencies 9 Installation Security. 74 Shared Files for All Instances of SQL Server 2000 74 Program and Data Files for the Default Instance of SQL Server 2000 75 Registering Servers 77 Removing Registered Servers 80 Best Practices 82 Chapter. Services Security 29 Auditing 30 SQL Server Auditing 30 Application Auditing 32 Chapter 2 Designing a Successful Security Model 35 Server Architecture 36 The Production Server 37 The Test Server