Related Chapters:

• Chapter 4: Attacking and Defending Windows XP Professional

• Chapter 5: Attacking and Defending Windows 2000

• Chapter 6: Securing Active Directory

• Chapter 11: Hacking Custom Web Applications

• Chapter 16: Network Architecture

Introduction

With all of the security hype out there focusing on Internet Information Server (IIS) worms, Trojan e-mail attachments, cross-site scripting, and Web site defacements, it might never occur to the average person that most corporate jewels do not lie on Web servers or desktops. Customer data, credit cards, passwords, and corporate secrets usually exist safely within the warm confines of your database systems not the ephemeral systems that appear to be constantly under attack. But, just how safe is your database system anyway? Is it possible that someone defacing your Web site might just be one hop away from the corporate jackpot? You betcha.

In this chapter, we discuss the security of one of the most popular database products for Web-based development: Microsoft's SQL Server 2000. We begin by briefly examining the history of SQL Server and investigating the different editions that are available. Next, we delve into an overview of the entire SQL Server security architecture and how the pieces work together.

After covering the background, we investigate how attackers identify, penetrate, and escalate privileges in a SQL Server environment. We identify all of the tools and techniques that potential attackers may use in order to turn your servers into theirs. Next, we turn the tables on the attacker and look at what you can do to...