Compliance

Deconstructing Governance (GRC)

• Risk Management

  Program for identifying risks and for developing plans to mitigate or remove risk.

• Governance

  Represents actions taken to address the risks identified during a risk assessment.  This is the step where polices, IT controls, practices, systems, and training are put in place to mitigate risks.

• Compliance

  Validation that identified risks have been mitigated.

  • Is there a policy in place to avoid a risk? 

  • Have the appropriate people been informed of these policies? 

• Note: Being able to answer these questions is the key to compliance.  The “Reaching Compliance” guide provides the guidance on how to validate compliance within the new features of SQL Server 2008.

To secure the platform:

• Ensure that you have a secure base for installing SQL Server ranging from the latest operating system and current service packs to installing the most current security patches and anti-malware software

• Minimize your surface area of attack by limiting running services, installing only the software needed, disable unnecessary ports and configuring the firewall

• But most importantly, ensure that you limit the users that have access to the server and roles

To control identity and ensure separation of duties:

• Use Windows Authentication for all database logins. Using this mode ties the SQL Server identity to an Active Directory account, providing a strong identity. Integrating access management with Active Directory Domain Services (AD DS) provides several benefits for SQL Server including consistent identity across servers and centralized enforcement and disabling of accounts and policies.

• Grant users access to databases as needed. You do this by creating individual user logins instead of security groups because the former provides more control over the logins. 

• Grant and deny needed permissions for users. This can be done easily by assigning those users to different database roles. This will allow you to place users in roles necessary to perform their jobs.

• The separation of duties (segregation of duties or role separation) is an important consideration when managing identity and permissions

• Use Policy-Based Management to validate identity policies

• Choosing an encryption algorithm is typically based on the degree of protection and the level of performance desired

• In SQL Server 2008, Transparent Data Encryption (TDE) was added to permit encryption of database data without the need to modify applications. TDE encrypts data files, log files, and backups.

• An important feature of TDE is the ability to backup and rotate certificate private keys. SQL Server audit specifications and/or policies can be used to ensure these actions are performed.

When choosing to audit:

• Determine which specific users and tables to audit. There can be many events within the audit logs and you may want to reduce the size of the logs by choosing to only audit specific users and tables.

• If you are monitoring more than one server, it may be beneficial to centralize logs to a central location

• The compliance within this SDK provides sample reports and scripts to process and create auditing reports against these log files

Using Policy-Based Management

• From the standpoint of compliance, the On Change, On Schedule, and On Demand features of Policy-Based Management allows regular health checks to be performed to determine who or what is violating policies or best practices, and when

• Creating a policy plan can identify the priority of policies. An incremental approach to creating policies is important for both management and performance reasons.

• The different execution modes of Policy-Based Management are dependent on the policy facet. You can view a table of which execution mode is applicable to which facets within the guide SQL Server Policy-Based Management: Facets

• This guide and sample files demonstrate how to use Policy-Based Management for implementing KPIs and KRIs, validate auditing configurations, and validate encryption configurations

• The Enterprise Policy Management Framework is a reporting solution that reports the state of the enterprise against a desired state defined in a policy. The EPM Framework extends SQL Server 2008 Policy-Based Management to all versions of SQL Server in an enterprise, including SQL Server 2000 and SQL Server 2005. The EPM Framework reports the state of specified SQL Server instances against policies that define the defined intent, desired configuration, and deployment standards.

• Programming interfaces to SQL Server

• Ensuring security settings

• Ensuring security settings

• Managing separation of duties

• Managing encryption keys

• Managing auditing including a full end-to-end centralized auditing project (including reports)

• Managing Policy-Based Management Policies