Securing SQL Server: DBAs Defending the Database

© Peter A. Carter 2018

Peter A. CarterSecuring SQL Serverhttps://doi.org/10.1007/978-1-4842-4161-5_12

12. Database Backup Theft

Peter A. Carter¹ 

(1)

London, UK

 

A common end goal of an attack against SQL Server is to steal data. An attacker is able to achieve this aim without even gaining access to the SQL Server instance, if they are able to gain access to database backups. In this scenario, they can simply restore the backup onto their own instance, gaining full, administrative-level access to all data within the database. In this chapter, we will refresh ourselves with the semantics of database backups before discussing how we can mitigate the risks of backup theft.

Overview of Backups

Depending on the recovery mode in use, there are three types ...