Security risks of using SQL Server without a firewall

Question

My question is prompted by the fact that WinHost.com has some really cheap shared hosting for SQL Server where you don't need to manage your own Virtual Private Server. Unfortunately there is no firewall so you can access the server from anywhere on the net as long as you know the username and password.

Personally, I'm not bothered by this for a startup project (which is the context of this question). Seems like a perfectly reasonable way to cut costs until you start making money. But there are others who would look at this like it's just the worst security catastrophe in the world just waiting to happen.

I can think of a few things that might happen.

1. Brute force attack.
2. Denial of service attacks.
3. Someone somehow gets a hold of some credentials to login, and now they can because their IP isn't blocked. This seems like the biggest problem to me... particularly if you have sensitive information.

For 1) this is not going to happen if you have a strong enough password. 2) would just be an annoyance as worst case scenario you move your database to a more secure hosting service. 3) Seems like the only real threat in my eyes.

So if I was presenting this as an option to someone who wanted to get a solution developed cheaply but wanted them to be fully aware of the risks, would this pretty much cover the possibilities or am I missing anything significant?

Answer 1

First hoping that IP address control can add strong security is kind of a brave assumption. IP theft should always be considered as a possible attack.

Next, if there is no firewall at all in front of a SQL server, the most serious risk is not legimitimate requests (i.e. with a correct username and password) coming from unlegitimate origins, but rogue attacks targetting possible flaws on the server itself, like unpatched vulnerabilities, or unwanted services left opened. This one would really be a risk on a production server.

Finally, end users should not directly connect to the database server on modern systems. A database server is a very large piece of code that admins prefere to hide behind an application server which is the only system that directly connects to the database. But if the application server and the database server are not in the same datacenter, the security of the database is only provided by its passwords. Full stop. At best, you could try to setup a VPN between the application host and the database server to provide an additional security layer, but I do not know whether it is an option on WinHost.

In the end, all this will boils down to security has a cost and the higher the security, to more expensive. But only you can know whether your security requirements are or not compatible with WinHost hosting: what are the threats, what is the risk/cost if the database is compromissed.

Now for your question:

Someone somehow gets a hold of some credentials to login ...

If you are there, do not worry for IP blocking or not, specially if you have sensitive or valuable informations. It is just time to change all the passwords and control the current data with the last safe backup... IP theft is a thing...

Answer 2

There are many vulnerabilities associated with database management systems. Basic security issues include:

1. Deployment security issues.
2. Application level (DBMS) security issues.
3. Abuse of database features
4. Zero day attacks
5. Data leaks

When your application is developed, another attack surface will be added to your database.

You can avoid brute-force attacks by using a strong password. But preventing against DDOS is somewhat difficult.

You can show them the risk associated with the system and have them sign to agree to this risk, if they cannot afford to mitigate the risk. But accepting a huge risk is also not acceptable.

Answer 3

I don't know how much money we are talking about, but your project should be adequately funded and security shouldn't be an afterthought. I am sure there is enough competition and that you should be able to find a suitable alternative.

The lack of a configurable firewall is a big downside I must say. You often get what you pay for. If you have a strong password, the server should withstand brute force attacks but it will be attacked by bots non-stop, resulting in wasted resources, possibly degraded performance. That's the nature of the Internet, servers are probed and attacked constantly.

But it is always possible that a 0-day for SQL Server will emerge at some point, and that is where the value of reducing the attack surface lies. If only one IP address is whitelisted for access, then the damage is pretty much contained.

Plus, there may be other services exposed on the server in addition to SQL Server. If they are not firewalled they may provide a possible opening for hackers.

I know what you are thinking, you can always migrate later when the project becomes profitable. But the reality of IT projects is that temporary setups very often become permanent, because we are lazy and migration can be a time-consuming experience and disrupting for customers. It's not something that we enjoy doing, we usually do this only when there is no choice because the current setup is no longer sustainable. So I warn you :)

You might as well host it yourself in the beginning, at least you'll have more control but you need the skills to properly configure and maintain the machine.

Answer 4

You can and should configure the software firewall on your virtual Windows(?) server. Just allow the ports for RDP and SQL server, and only for the IP ranges relevant for you. Also make sure that your SQL server provides TLS-encrypted connections so your credentials and data is encrypted in-transit.