Because I’m lazy I’m going to say that this post is a response to Brent Ozars TSQL Tuesday invite. It’s wasn’t originally, it’s a week laste, but it kinda fits so let’s roll with it and not ask too many questions?

Brent asks “What was the last ticket you closed?” Unlike most of the respondents I do work in a system where tickets are a real thing and they do largely drive me day. Everything gets turned into tasks, these are tracked against budgets and deadlines and the ticketing system RULES OUR LIVES!

But the last ticket I closed wasn’t actually a ticket, it was a task in Microsoft to-do, or planner, or whatever it’s being called this month. I have a recurring task for several pieces of our documentation that prompts me to go and review what is written, and if necessary to change it.

Why would I do that? Well put simply, I hate documentation, but I hate documentation slightly less than I hate ‘lack-of-documentation’. I’m primarily a technical person and I like to have a list of things or a process to follow for repeatable tasks. Ideally I like to automate them, but that’s something you do after you have a reliable process, not before. I also like to make sure that any process my colleagues have to work through has a nicely documented set of steps too, but the problem is that sometimes that changes as you change your infrastructure, or SaaS products, or software changes or a bunch of other things. The problem is that documentation is seldom scoped as part of any project, and if it is it’s rare that it’s scoped sufficiently to actually do the documentation justice.

And why is hunting down outdated documentation particularly important right at this point of time? Because the world is changing, and we are unleashing AI on our systems, and it’s pulling recommendations from documentation we wrote 5 years ago and never updated or removed from the system. I want to work in an organization that is AI ready, and unfortunately that means a certain amount of legwork to work through all the different boring bits of source material that AI is going to be using to create it’s responses.

There’s a huge amount of buzz about Artificial Intelligence at the moment, and rightly so. But not enough discussion about the groundwork that’s needed for good results. Put simply the businesses that have prioritised structure, process and documentation will reap the benefits of that investment as they integrate AI into their workflows. The businesses who haven’t are the ones that will find AI giving them the strangest answers and have the lowest level of trust in what AI is doing for them. Let’s face it, there’s a lot of these businesses out there, and they are the most likley to jump in feet first to the AI world looking for a miracle that they simple haven’t earned yet.

So, closed? Temporarily. I’ve completed the key bits, but this is a ticket that is never really closed. If we want to get best value from AI we need to make sure it’s source data is as accurate as possible and that’s an ongoing process. Maybe with the right prompting it’s a task AI can eventually take over itself, but until then…. Garbage in-garbage out. Funny how working with data just keeps coming back to the same concepts isn’t it?

It’s 2024 – and SQL Injection is still a thing. It’s hard to believe that people aren’t aware of the possibility of a SQL injection attack in the current environment, but here’s a thought – it’s going to get worse. Why do I say that? Because instead of having a sensible developer with 30 years of dealing with idiots attacking their code and trying to make it do things it’s not meant to, you are going to have code going into production written by AI responding to a prompt like “Hey CHAT GTP – how do I write a form that people can send me comments about their order through?”. **SIGH** Let’s take a step back.

Imagine leaving your front door wide open, with a sign saying, “Welcome, come in!” That’s what a poorly secured SQL Server feels like to a malicious actor exploiting SQL injection vulnerabilities. SQL injection is a technique where attackers inject malicious SQL code into input fields, tricking the database into executing commands it shouldn’t. It’s one of the most common and devastating attack methods, and as a SQL Server DBA, it’s your job to ensure the door stays locked.

SQL injection doesn’t discriminate—it targets any system that relies on improperly sanitized user inputs. Picture a login form that asks for a username and password. If the application inserts these inputs directly into a SQL query without validation, an attacker could manipulate the input to bypass authentication, exfiltrate data, or even gain administrative control. For example, entering ' OR 1=1 -- as a password might turn the SQL statement into something always true, effectively allowing the attacker in without knowing any credentials.

As I mentioned above, we are going to get an increase in the number of inexperienced people putting code into the world. We simply can’t rely on the frontend being secure. It may be…and that would be great, but if our SQL Server is being breached because someone wrote a poor app it’s as much the DBA’s fault for not closing the door as it is the developers for opening it.

Defending against SQL injection requires more than locking down your SQL Server—it’s about creating multiple layers of defense, much like securing a fortress. The first line of defense is always input validation and parameterized queries. Instead of allowing raw input to dictate how your queries are constructed, parameterized queries use placeholders for inputs, ensuring the database treats them as data rather than executable code. Think of it as giving someone a safe deposit box key that only works for one specific box, rather than granting them access to the entire vault. We can look for that as DBA’s, and we can talk to our developers about the queries that they are writing.

Moving on from a parameterized query we can enforce input via stored procedures and now the code sits in the DBA realm. By encapsulating SQL code in a controlled environment, you reduce the risk of input tampering. However, don’t fall into the trap of thinking all stored procedures are inherently safe. If you dynamically construct SQL strings within a stored procedure, the risk of injection remains. And you want to know when stored procedures are failing. If you write it in such a way that it cannot fail so long as the input is valid – when it fails what does that tell you?

Another crucial defense mechanism is principle of least privilege. Every application user doesn’t need administrative access to the database. Instead, grant permissions based on necessity. If a user only needs to read data, don’t let them modify it. This limits the potential damage of a successful SQL injection attack. What’s more, SQL Server has a wonderful feature called roles that everybody uses like this: Do you need read access – I’ll give you db-reader, do you need write access – I’ll give you db_writer, oh you need both – I’ll give you db_owner. It’s crazy. SQL Server access is so much more granular than that. It you are exposing your database to a web app – what access does that app actually need? Oh it only writes to one table? So give it access to just that table. I know it’s more work and fiddlier – but it protects your data. So do it.

Encryption also plays a role. While it won’t stop an injection attack, encrypting sensitive data—like passwords—adds another barrier. Even if attackers gain access, encrypted data is far less useful without the decryption key.

Finally, don’t underestimate the power of monitoring and auditing. Tools like SQL Server Audit can track login attempts and query execution, providing early warning signs of unusual activity. Regular penetration testing is also invaluable; it’s like hiring a locksmith to find weaknesses in your security setup before a burglar does.

SQL injection is a persistent threat, and it’s probably going to get worse rather than better, but it’s not an inevitable one. By treating your SQL Server like a fortress and layering your defenses, you can ensure that even the most determined attacker finds nothing but locked doors. After all, security isn’t just about keeping bad actors out; it’s about building trust with those who rely on you to safeguard their data. And in this case, trust is the most valuable currency of all.

This month’s TSQL Tuesday is bought to us by Kay Sauter and asks us to have a think about who needs a thank you thrown their way. As I wind down to go on leave for the year, I’m reflecting on what a crazy year 2023 has been. I wrote this a week ago, and then I got covid which gave me even more time to mull things over, so I’m going to completely rewrite it and thanks someone different!

First thanks obviously goes to family and friends who put up with me. To my wife who rings me and reminds me that I stopped getting paid at 5 and maybe it’s time to come home. To my girls for listening to me recite the latest episode of Darknet Diaries or prattle on about why their school grades are stupid and ours were so much better. “Daddy I got an E” still sounds like a bad thing to me. I will never accept it is the best grade there is. How am I meant to index things in my head if they aren’t alphabetical? We don’t live in hogwarts!

Oh….and I should mention a quick thanks to my blog readers for holding back on the flames when I take off on a tangent.

Secondly, I want to throw out a thank you to some people who really don’t get thanked enough – ourselves. I’m talking about all the people who collect, guard and use data. Every now and then I stop and think about all the amazing things that we do with data and how very lucky we are to be right on the edge of so much of the exciting changes that are happening in the world.

As SQL professionals we are doubly lucky because not only do we have a great product to work with, we have an amazing community to be a part of. I had the fantastic opportunity of travelling to PASS Summit in Seattle last month and was reminded what a special group of people form this community. I want to call out all those who lead sessions – not just at PASS but at SQL and data events everywhere. We deal with a lot of complex topics and sometimes it just takes the right presentation of something and it all clicks into place. For me that usually comes with a comparison, or a story about when something was used in the wild, and those come from blogs, SQL events, or catching up with people in the industry for a beer. I want to extend that community thanks to the folks who have made products, training and code available. Imagine being a DBA without the first responder kit, DBATools, Ola’s maintenance scripts or sp_whoisactive! Imagine if you had to solve every problem from scratch instead of paste an error message in google and be lead straight to someone’s blog where you can read about the why and the how. We are part of an amazing community and I want to take this chance to thank all the SQL heroes – past, present and future.

Encrypting SQL Server Connections with SSL/TLS: A Practical Guide for DBAs

As a SQL Server Database Administrator (DBA), ensuring the security of data in transit is a critical responsibility, but messing around with server certificates and encryption is not something we are always familiar with. In this article it’s time to figure it out as SSL/TLS (Secure Sockets Layer/Transport Layer Security) encryption safeguards against threats such as man-in-the-middle attacks, ensuring data integrity and confidentiality.

Why Encrypting Connections Matters

Unencrypted connections are a liability. Data transmitted over the network can be intercepted and exploited by malicious actors, leading to data breaches and compliance violations. DBA’s often assume that protecting the data starts with strong access protection, but we need to remember that data can become exposed after it’s left the fortress of the database server, and we can’t rely on the application for that.

Encryption adds a protective layer, ensuring that even if data is intercepted between the database server and the client application, it remains unintelligible without the decryption key.I’ve been talking about SQL Encryption for years now, but it is actually the move to compliance that has started getting people to pay attention. Going beyond the security benefit, encryption is often a compliance requirement for standards like GDPR, HIPAA, and PCI DSS.

Steps to Configure SSL/TLS Encryption in SQL Server

Configuring encryption for SQL Server involves several steps. Here’s a streamlined approach to get you started:

1. Obtain and Install an SSL/TLS Certificate

• Acquire a certificate from a trusted Certificate Authority (CA) or create a self-signed certificate for internal testing purposes.
• Ensure the certificate includes the SQL Server’s hostname and has a private key.
• Install the certificate on the server hosting SQL Server by importing it into the Windows certificate store under the “Personal” folder for the local computer account.

2. Configure SQL Server to Use the Certificate

• Open the SQL Server Configuration Manager.
• Navigate to the SQL Server Network Configuration -> Protocols for [Your Instance].
• Right-click “Protocols for [Your Instance]” and select Properties.
• Under the Certificate tab, choose the installed certificate from the dropdown.
• Set Force Encryption to “Yes” under the Flags tab if you want to mandate encryption for all connections. This is not always possible so make sure all your applications allow it. Additionally you need to consider that a failed connection attempt from lack of encryption is not a failed login. That means it doesn’t show up in your SQL Server event log – you need another way of detecting it(hopefully not from people yelling at you that things don’t work).

3. Configure Client Connections

• Ensure client applications are configured to use encryption.
• For SQL Server Management Studio (SSMS), enable the “Encrypt connection” option in the connection settings.
• If using custom applications, confirm the connection strings include the Encrypt=True and TrustServerCertificate=False parameters for proper validation.

4. Verify Encryption

• Use tools like Network Monitor or Wireshark to confirm encrypted traffic between the server and clients.
• Alternatively, query sys.dm_exec_connections DMV in SQL Server and check the encrypt_option column to verify active encrypted connections.

Best Practices for SSL/TLS Encryption

1. Use Strong Certificates: Ensure certificates use modern encryption algorithms like SHA-256. Avoid deprecated protocols like SSL 3.0 and weak cipher suites.
2. Regularly Update Certificates: Monitor expiration dates and replace certificates before they expire to prevent service disruptions.
3. Test in a Non-Production Environment: Validate your encryption setup in a staging environment to identify and resolve potential issues before rolling it out to production. When it does come time to roll into production, use a multi-step process. First add the certificate and update your connection strings. Then monitor the sys.dm_exec_connections DMV to ensure that all connections are being encrypted before flicking the switch and requiring encrypted connections. This way you can identify and update any connection strings that you missed earlier, and correct the issue, rather than just causing them to fail.
4. Monitor and Audit Connections: Continuously monitor SQL Server logs and use auditing tools to ensure encrypted connections are consistently enforced.

It turns out that securing SQL Server connections with SSL/TLS encryption is a pretty straightforward task for any DBA. As with most things SQL the technical implementation is not the tricky bit. Ensuring you know where your traffic is coming from and which connection strings need updating is the trickier part of the process.

For this months TSQL Tuesday Matthew McGiffen asks us some broad questions around Encryption and Data Protection. His timing is great, because that’s exactly what I gave a talk about last month at SQL Saturday South Island. My timing is not so great. It’s Thursday. I could tell you about Tuesday, but I’m not sure you would believe me. So apologies for being late Matthew, thanks for the great topic which I keep telling everyone who will listen we all need to keep front of mind.

I’m going to start off in the past, where Encryption was a big scary thing for me. I didn’t get it. It was complicated and seemed like some hidden voodoo science that I just wasn’t smart enough to understand. One thing I’ve learnt though is that not understanding the intricacies of how something works is actually not that bigger deal so long as you understand what it is used for, when it’s appropriate to use and how to go about implementing it. Embracing my inability to know everything about everything is something I actually recognize as a big career turning point for me, and if it hasn’t been for you yet then I’ve got a thing called AI that we need to have a chat about.

At any rate, a little less distantly in the past I presented at SQL Saturday SOuth Island and did demo’s inside an hour on how to do the following forms of ‘encryption’.

• WITH ENCRYPTION object ‘encryption’
• Connection Encryption
• Transparent Data Encryption
• Backup Encryption
• Always Encrypted Column Encryption

5 forms of encryption in an hour. When to do it, why to do it, and how to do it – take my code. But that wasn’t the point of the talk. Hopefully what people took away from the talk was that there is no technical barrier to them going away and implementing encryption in their environment straight away. The features are available in all paid editions of SQL Server, the process is really well documented, and they had just witnessed someone implement them all in a handful of minutes.

The stuff that really matter is the bits around the protection. What is the impact of encryption on your database size…your backup size…your ability to use third party dedupe products…your developers process…your compliance…your security. Each one of those things is a blog post in itself (oh good…no more wondering what to blog about next month…) but the one I want to focus in on is a human element and it’s something I have had to deal with directly in the past week (See reference to Tuesday above).

As employees we are often tasked with figuring out how to get something done quickly. We have an incredible ability to figure out the ‘how’ to a problem, and we live in a glorious age where the ‘how’ knowledge is readily and generously shared by a multitude of online genius types. So when someone says ‘encrypt this column’ it’s quite possible that a moderately competent IT professional can figure out the how, make that column encrypted and tick whatever compliance box their boss was worried about that week.

What we are often not so good about is documentation and knowledge transfer, particularly of an ad hoc task that took us a couple of hours several years ago. The biggest problem I have with encryption is that people change roles, and change jobs, and fall out of trees. When any form of encryption is in place, we run the risk of ending up in a state where data is irreversibly encrypted because the certificate is lost – or we have a backup, but not a private key or a decryption password. I don’t want to make people afraid of encryption, but I do want people to be very aware that the technical implementation of encryption is not the hard part. The hard part is agreeing and documenting all the things that go round encryption.

So my call to action to you – person with TDE in your environment, and you – person with Always Encrypted implemented on a server near the end of it’s life – is to make sure more than just you know how to access the backups or certificates and know where your process is documented.

You won’t thank me for this, it will be one more long boring task to work your way through, but if you don’t do it – you, or whoever inherits your environment, may well curse the name of whoever introduced encryption into your workplace. And that would be a shame.