2

The CISO of my company is currently away and as IT manager I have been asked to send some security questions to a company hoping to implement an SQL database to manage salaries, orders etc.

I have very little experience regarding SQL, I have included my list of 9 questions below, have I missed any obvious questions?

  • How does your solution protect against SQL Injection attacks? Your application has an wide amount of functionality, do you utilize Prepared Statements, Input Validation etc?

  • How does your product protect the usernames and passwords for accessing the database? Are the passwords hashed and salted, if so which hashing functions and salting mechanisms do you use? Additionally, if salts are being used are different salt values used for each individual password?

  • Is your solution regularly tested with penetration tests? If so how often and please would you provide the name of the company that carried out the testing? Also if we have an independent penetration test will this break any Terms of Use, ie are we still covered to receive full support and services from you?

  • Regarding backups, you mentioned that these can be implemented for automatic backups, can encryption of the backups be done automatically through your product also or is this done manually?

  • I noticed that you are using SQL Server Version 2014, is it possible for this to be migrated to a newer version?

  • You mentioned about costs changing for each database if the workflow is different, regarding this if we wanted to start using your solution only in a LAN environment (no remote access) and wanted to include remote access at a later date would this cost us more? I imagine this is simply a case of opening a port on the server.

  • You mentioned that you are able to implement VPN access to the SQL server, which VPN protocols does your application support? L2TP, IPsec etc?

  • Are there any logging capabilities included? Can the admin see which user logged on, what actions were taken and from which IP address or do you provide an Intrusion Detection System to do this?

  • 1
    I think there's some information missing. Are you contacting a vendor with these questions? For example, VPN seems to be unrelated to a database server and application, but pertinent to a vendor providing support. Can you clarify? – h4ckNinja Nov 20 '17 at 3:37
  • @iopa27 - are you interested in information about a couple of third party products that are alternatives to TDE and work with all versions and editions of SQL Server? If so, I can post them here. (Disclaimer: I am from NetLib Security – Neil Weicher May 6 '19 at 11:59
1

WRT upgrading: Don't ask if it's possible, demand to know when it will be upgraded and to see the upgrade path to future versions of SQL.

WRT logging: there must be logging. As a customer, I want to see whether anyone has done anything with the database, including vendor admins. Who has rights to logging? What reporting will I receive free of charge? Who can run reports? Who has rights to the audit logs? (I want to be sure that, if someone goes rogue, that the rogue employee doesn't have rights to remove their actions from the audit log)

What about physical security to the data center where it will be housed? Who has access and how is that access determined?

Are background checks performed on their employees with access to your data?

Are "least privileges" maintained with respect to your data? How often is access reviewed? How long does it take to remove the rights of terminated employees (whether willfully or unwilling) from your data?

Are all default passwords changed?

Those are some of the questions we often ask of outsourced providers; apologies if you already ask these questions.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.