Securing Backups in Microsoft SQL Server

Backing up database without password containsThe following commands can be used to provide a
several vulnerability ofpassword. I assume that you have
disclosing the confidential information. The reasona backup media and backup device name 'backup01'.
that any database can be
restored at any location makes this problem moreStatement#1
serious. You can check it outBackup database Northwind to backup01 with
by creating a Backup of your database and restoringpassword='secretpass'
it in some other machine.
The information stored in your backup media alsoNow, let us have a test on this and see what SQL
get disclosed by - RestoreServer says when password is
filelistonly or Restore headeronly options. Backing upnot provided.
a database without
supplying password could lead to several anomaliesRestore database Northwind from backup01
that no company would like to
suffer.Server: Msg 3279, Level 16, State 2, Line 5
Access is denied due to a password failure
Some common problems concerned -Server: Msg 3013, Level 16, State 1, Line 5
RESTORE DATABASE is terminating abnormally.
This was an error with severity level 16. That means
(1) Disclosing of company information, such asit's working. Now, let us
customers, policies and futurehave a look on restore related commands that
plans.produce some information.
(2) Disclosing of contact information or accountsRestore Filelistonly From backup01
information especially in case
of Bank or Insurance companies.Server: Msg 3279, Level 16, State 2, Line 5
Access is denied due to a password failure
(3) Disclosing of structure of the storage pattern ofServer: Msg 3013, Level 16, State 1, Line 5
the company.RESTORE DATABASE is terminating abnormally.
(4) Utilization of future plans by rival companies.Again the same error. In this way, we may conclude
that this approach is easier
These are common problems, but there areto create this. Some other options can also be
numerous specific problems that couldprovided like media name, media
be faced. Let's have an estimate of some reasonsdescription and media password.
why backup set must be password
protected -Media Name, Media Description and Media Password
There are some differences in directly applying
(1) Backups in Tapes is not kept in a secure manner.password while backup and using
media name. When you are using following command
while backup.
This is also recommended to store all the backup
off-site. In such cases whereStatement#2
your company stores Tapes off-site, there could beBackup database Northwind to backup01 with
some physical securitymedianame='Set-1' , mediapassword='passwd'
problems of there storage. There are cases when
disgruntled employees have soldThis would create password for backup01 and once
these tapes to rival companies to gain better perkit was done, you get the same
and confidence in rivalerror Msg 3279 while you execute the following
companies. As you all know, each company wantscommand on the same media.
to know the structure and pattern
followed by other company. A employee ofBackup database Northwind to backup01
company may be unfaithful and he can
damage some information. But damaging some dataSo, when your provide password for the media, you
is not a big issue than sellingcan not backup any information
or disclosing information.into media unless you provide password. After the
Statement#2 you need to
(2) Backups can be sent as e-mail or uploaded.provide password for other backups.
This problem is not hidden to anyone. Your companyBackup database MSDB to backup01 with
firewall may be strong, butmedianame='Set-1' , mediapassword='passwd'
Thumbnail drives can anytime be applied in USB port
and data can be transferred.The statement executes successfully. This is the
Thumbnail drives are nowadays in fashion also.actual difference in using
Anyone can have a 1GB to 10GB of'with password=' and 'with medianame' case. After
such thumbnail drives. The important thing to noticeexecuting Statement#1, you can
about thumbnail drives isuse the same for other backups without mentioning
that they do not require installation. Just plugging intopassword or mentioning
USB port and computerdifferent passwords.
shows a Removable media and then copy and paste
of files. This is so easy to doConclusion
that a newbie can do this.
This is all about providing protection for passwords.
How to provide security in Backups ?There are many other
things to research in the same scenario and I would
This only requires to add an option of password tolike to share my ideas when
make your backup set passwordsuch studies are complete. Overall, my aim was to
protected. The advantages of providing password inopen your eyes that backups
backup are -are not only to secure your data, but due to
carelessness this may lead to
(1) Restore Filelistonly, Restore Headeronlyleakage of information. In my opinion, disclosure of
commands does not discloseimportant information is
the backup information.more serious matter than loss of information. So,
(2) If you want to restore from media, error isawareness is important and
generated by SQL Server.there is a little effort to apply in securing your
backups.