question

jagadeesh avatar image
jagadeesh asked

sql security

Hi In Multi-domain Infrastructure, we have recently switched to use Windows Authentication to connect to our db instances. We are using the runas.exe command to lauch SSMS as the domain\username from our laptops running in our local domain. It has come to our attention during a recent security scan that the initial connection to the db is not secure and a plain text payload can be viewed containing instance name, domain user name, etc... Do you have any experience/advice as to how we can make this connection secure? SQL Server on 2014 - so is there anyway i can use always encrypted for 2014 or any recommendations for this ?
sql security
10 |1200

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

1 Answer

·
ThomasRushton avatar image
ThomasRushton answered
Yes, there are things you can do to further protect yourself. Have a look at Denny Cherry's book on [Securing SQL Server][1], specifically chapter 2. I don't have it handy, but there's discussion about this sort of problem. [1]: https://www.amazon.co.uk/Securing-SQL-Server-Protecting-Attackers/dp/1597499471
10 |1200

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.