security-center-for-sql-server-database-engine-and-azure-sql-database.md

title	description	ms.custom	ms.date	ms.prod	ms.prod_service	ms.reviewer	ms.technology	ms.topic	f1_keywords	helpviewer_keywords	ms.assetid	author	ms.author	monikerRange
Security documentation for SQL Server & Azure SQL Database	A reference of security and protection-related content for SQL Server and Azure SQL Database.	seo-lt-2019	09/27/2017	sql	database-engine, sql-database, sql-data-warehouse, pdw		security	conceptual	Security [SQL Server]	SQL Server, security security [SQL Server] database security [SQL Server] databases [SQL Server], security	dfb39d16-722a-4734-94bb-98e61e014ee7	VanMSFT	vanto	>=aps-pdw-2016||=azuresqldb-current||=azure-sqldw-latest||>=sql-server-2016||=sqlallproducts-allversions||>=sql-server-linux-2017||=azuresqldb-mi-current

Security Center for SQL Server Database Engine and Azure SQL Database

[!INCLUDEappliesto-ss-asdb-asdw-pdw-md]

This page provides links to help you locate the information that you need about security and protection in the [!INCLUDEssDEnoversion] and [!INCLUDEssSDSFull].

Legend

Authentication: Who are you?

Who Authenticates? Windows Authentication [!INCLUDEssNoVersion] Authentication Azure Active Directory	Who Authenticates? (Windows or [!INCLUDEssNoVersion]) Choose an Authentication Mode Connecting to SQL Database By Using Azure Active Directory Authentication
Where Authenticated? At master Database: Logins and DB Users At User Database: Contained DB Users	Authenticate at the master database (Logins and database users) Create a SQL Server Login Managing Databases and Logins in Azure SQL Database Create a Database User Authenticate at a user database Contained Database Users - Making Your Database Portable
Using Other Identities Credentials Execute as Another Login Execute as Another Database User	Credentials (Database Engine) Execute as Another Login Execute as Another Database User

Authorization: What can you do?

Granting, Revoking, and Denying Permissions Securable Classes Granular Server Permissions Granular Database Permissions	Permissions Hierarchy (Database Engine) Permissions Securables Getting Started with Database Engine Permissions
Security by Roles Server Level Roles Database Level Roles	Server-Level Roles Database-Level Roles
Restricting Data Access to Selected Data Elements Restrict Data Access With Views/Procedures Row-Level Security Dynamic Data Masking Signed Objects	Restrict Data Access Using Views and Procedures Row-Level Security (SQL Server) Row-Level Security (Azure SQL Database) Dynamic Data Masking (SQL Server) Dynamic Data Masking (Azure SQL Database) Signed Objects

Encryption: Storing Secret Data

Encrypting Files BitLocker Encryption (Drive Level) NTFS Encryption (Folder Level) Transparent Data Encryption (File Level) Backup Encryption (File Level)	BitLocker (Drive Level) NTFS Encryption (Folder Level) Transparent Data Encryption (File Level) Backup Encryption (File Level)
Encrypting Sources Extensible Key Management Module Keys Stored in the Azure Key Vault Always Encrypted	Extensible Key Management Module Keys Stored in the Azure Key Vault Always Encrypted
Column, Data, & Key Encryption Encrypt by Certificate Encrypt by Symmetric Key Encrypt by Asymmetric Key Encrypt by Passphrase	Encrypt by Certificate Encrypt by Asymmetric Key Encrypt by Symmetric Key Encrypt by Passphrase Encrypt a Column of Data

Connection Security: Restricting and Securing

Firewall Protection Windows Firewall Settings Azure Service Firewall Settings Database Firewall Settings	Configure a Windows Firewall for Database Engine Access Azure SQL Database Firewall Settings Azure Service Firewall Settings
Encrypting Data in Transit Forced SSL Connections Optional SSL Connections	Enable Encrypted Connections to the Database Engine Enable Encrypted Connections to the Database Engine, Network security TLS 1.2 support for Microsoft SQL Server

Auditing: Recording Access

Automated Auditing [!INCLUDEssNoVersion] Audit (Server and DB Level) [!INCLUDEssSDS] Audit (Database Level) Detect threats	SQL Server Audit (Database Engine) SQL Database Auditing Get started with SQL Database Advanced Threat Protection SQL Database Vulnerability Assessment
Custom Audit Triggers	Custom Audit Implementation: Creating DDL Triggers and DML Triggers
Compliance Compliance	SQL Server: Common Criteria SQL Database: Microsoft Azure Trust Center: Compliance by Feature

SQL Injection

SQL injection is an attack in which malicious code is inserted into strings that are later passed to the [!INCLUDEssDE] for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because [!INCLUDEssNoVersion] will execute all syntactically valid queries that it receives. All database systems have some risk of SQL Injection, and many of the vulnerabilities are introduced in the application that is querying the [!INCLUDEssDE]. You can thwart SQL injection attacks by using stored procedures and parameterized commands, avoiding dynamic SQL, and restricting permissions on all users. For more information, see SQL Injection.

Additional links for application programmers:

• Application Security Scenarios in SQL Server

• Writing Secure Dynamic SQL in SQL Server

• How To: Protect From SQL Injection in ASP.NET

See Also

Getting Started with Database Engine Permissions
Securing SQL Server
Principals (Database Engine)
SQL Server Certificates and Asymmetric Keys
SQL Server Encryption
Surface Area Configuration
Strong Passwords
TRUSTWORTHY Database Property
Database Engine Features and Tasks
Protecting Your SQL Server Intellectual Property

[!INCLUDEget-help-security]