Securing SQL Server: DBAs Defending the Database

© Peter A. Carter 2018

Peter A. CarterSecuring SQL Serverhttps://doi.org/10.1007/978-1-4842-4161-5_8

8. Protecting Credentials

Peter A. Carter¹ 

(1)

London, UK

 

Stealing the credentials of a security principal, with the intent of elevating your allowed permissions, is known as identity spoofing. There are various ways that an attacker may attempt to steal credentials. This chapter will discuss some of those methods, as well as countermeasures that you can put in place to mitigate the risk.

Protecting the sa Account

Although it has long been best practice to use Windows Authentication, as opposed to Mixed Mode Authentication, which allows authentication using both Windows Authentication and SQL Authentication, the majority of corporate instances (in my ...