Courses and Conferences

Contact
  1. Danish Technological Institute
  2. Services
  3. Courses and Conferences
  4. Masterclass: Hacking and Securing SQL Server [HSS]
DTI Main Reception

Do you need help?

  • Gregersensvej 8
  • 2630 Taastrup
Google MapsApple MapsRejseplanen
  • Forskerparken Fyn, Forskerparken 10F
  • 5230 Odense M
Google MapsApple MapsRejseplanen
  • Teknologiparken Kongsvang Allé 29
  • 8000 Aarhus C
Google MapsApple MapsRejseplanen
  • NordsøcentretPostboks 104
  • 9850Hirtshals
Google MapsApple MapsRejseplanen
  • Gammel Ålbovej 1
  • 6092Sønder Stenderup
Google MapsApple MapsRejseplanen
5 days virtual course

Masterclass: Hacking and Securing SQL Server [HSS]

In this workshop you will analyze, learn and practice critical tasks for implementing highly secure SQL Server infrastructure. We’ll start with identifying security needs regarding database servers and look at the most common attack types and use them on ‘out of the box’ installation. In simple words we will hack our systems!

Then we will discuss impact of system and network security on databases server. Next, we will go through every layer of protection offered by SQL Server with lots of real-life examples and hands on labs. At the end we will look at the monitoring and auditing our infrastructure to detect threats and react to them. Additionally, we’ll play with security of other SQL Services and Azure SQL Databases. Our goal is to show and teach you how to protect your precious data in SQL Server environment and how database security mechanisms work. After the course you will be able to test and secure your SQL Server infrastructure.
 
To get more practice we offer three extra weeks of labs online!
 

Prerequisites

To attend this training you should have good hands-on experience in administering Microsoft SQL Server infrastructure. At least 5 years in the field is recommended.

Target audience

This course is a must-go for database administrators, IT professionals and security officers dealing with database servers. Database administrators, infrastructure architects, security professionals, system engineers, advanced database developer, IT professionals, security consultants and other people responsible for implementing databases security.

At the end of the course you will be able to

After the course you will be able to test and secure your SQL Server infrastructure. And to get more practice we offer three extra weeks of labs online! We want you to leave the class with scripts, checklists and practical, ready-to-use knowledge of how to hack, test and secure your SQL Server infrastructure.

Content

Module 1 Hacking SQL Server Infrastructure
  • Discovering SQL Server instances
  • SQL injection using men in the middle
  • Capturing SQL credentials using men in the middle
  • Decrypting SQL Logins passwords
  • Gaining access to SQL Server on compromised
  • Windows Server
Module 2: SQL Server security baseline concepts
  • Defining security objectives
  • Configuring service accounts
  • Auditing database permissions
  • Implementing physical protection
  • Configuring firewall
  • Securing client-server communication
Module 3: SQL Server Instance security
  • Limiting permissions
  • Securing CLR
  • Implementing protection for extended procedures
  • Protecting linked servers (OPENROWSET)
  • Securing by using policies
  • Hiding instance metadata
Module 4: Managing Logins and Passwords
  • Authentication options
  • Implementing password policies
  • Securing connection strings
  • Customizing login / user authorization
Module 5: Encryption in SQL Server
  • Key management
  • Code and data encryption
  • Managing certificates
  • Transparent database encryption
  • Encryption in HA and Disaster Recovery
Module 6: Protecting database backups
  • Securing backup files
  • Setting backup file passwords and encryption
  • Handling keys and certificate backups
  • Security considerations while restoring to another SQL Server instance
Module 7: Monitoring and auditing
  • Login auditing options
  • Data access auditing
  • Data Manipulation Language custom auditing
  • Policy-based management
  • Forensics case study
Module 8: Securing other SQL Server services
  • SQL Server Agent
  • SQL Server Analysis Services
  • SQL Server Reporting Services
  • Azure SQL Database

Materials

Author’s unique tools and scripts, over 100 pages of exercises, presentations slides with notes

CPE Points (Continuing professional education)

It will be possible to earn CPE points after completion this course. All exercises are based on SQL Server 2019 and Windows Server 2019.

Form

Virtuelt med live underviser

Før deltagelse i et virtuelt kursus, vil vi altid forsøge at arrangere en testsession på 15 - 20 minutter en uges tid før, for at sikre, at alle er i stand til at deltage i masterclassen. Herunder finder du kravene til at oprette forbindelse til det virtuelle kursus:

  • En computer med en stabil internetforbindelse (skal helst køre Windows eller Mac OS).
  • Tilladelser til udgående RDP-forbindelser til eksterne servere (til vores laboratoriemiljø) – port 3389
  • Et headset (hovedtelefoner og mikrofon)
  • Webcam (indbygget eller tilsluttet)
  • En ekstra skærm er nyttig, men ikke påkrævet

Instructor

M
Mike Jankowski-Lorek is a solution architect, developer, data scientist and security expert with more than 12-years’ experience in the field. He designs and implements solutions for Databases, Network & Management area, mainly for Microsoft platform for medium to enterprise level organizations. Mike holds multiple certifications, especially security, database and software development related. He is one of core Experts at CQURE and holds a PhD in Computer Science.

Do you have any questions please contact