Checking for the “Default” username

You can check for the presence of this login by running the query below. If found, a full network audit is recommended.

--Verify the default account doesn't exist.  No results is a good thing.
SELECT 
	[name],
	[type_desc],
	is_disabled,
	create_date,
	modify_date
FROM sys.server_principals
WHERE [name] = 'Default'

What if you already had a login named “Default”? Determine if the password was recently changed to “@fg125kjnhn987” and if there have been any recent login failures. Review for any recently created logins as well. Are all logins accounted for? Were any created that you were not aware of? If so, review each further to determine what permissions they have and identify what they’re being used for.

--Review recently created logins
SELECT 
	[name],
	[type_desc],
	is_disabled,
	create_date,
	modify_date
FROM sys.server_principals
ORDER BY create_date desc

Review recently modified logins.

--Review recently modified logins
SELECT 
	[name],
	[type_desc],
	is_disabled,
	create_date,
	modify_date
FROM sys.server_principals
ORDER BY modify_date desc

Avoid making your SQL Servers easy targets

By utilizing security best practices, most brute-force attacks can be stopped. Or, at the very least, set off alarm bells and whistles to alert you of suspicious activity. Below is a list of do’s and don’ts we typically recommend. This is not an exhaustive list.

Don’t

1. Don’t expose your SQL Servers to the internet (if at all possible). Use a VPN to access externally.
2. Don’t use weak passwords (for any account).
3. Don’t add your SQL Server service accounts to the local admin group.
4. Don’t grant your SQL Server service accounts more permissions than required.
5. Don’t grant logins more permissions than required.
6. Don’t install additional services which are not required. SQL Server licenses include not only the database engine, but integration services, analysis services, and reporting services as well (at the time of this post). It’s easy enough to go ahead and install these additional services but also increases the attack surface area. Only install what is required.
7. Don’t enable additional options, within SQL Server, if unneeded. For example, xp_cmdshell, Ole Automation Procedures, and ad hoc distributed queries.

Do

1. Patch often. Review latest cumulative update, service pack releases, and hotfixes. Start here.
2. Implement a policy in which an account will become locked out after X number of attempts.
3. Change passwords often.
4. Audit the creation of new logins (and review the audits often 😉).
5. Disable the SA account. This account is well known and has unfettered access.
6. If not required, don’t use SQL Server authentication.
7. Review failed login attempts. Especially those occurring numerous times within a short span of time. This could be an indication of a brute-force attempt.
8. Implement a process to audit using guidelines such as the US government Security Technical Implementation Guides (STIGs) or Center for Internet Security (more on these below).
9. Review the health and performance metrics of your SQL Servers regularly.
10. Proactively monitor your SQL Servers to look for unexpected deviations of resource consumption.

Audit your environment

These types of exploits can typically be avoided. Implementing good security practices can be a painful process (not only from a technical perspective but also from the staff and end user perspective). The following guides provide a large set of information and scripts to get you started with securing your environment.

CIS – Center for Internet Security

CIS Benchmarks are consensus-developed secure configuration guidelines for hardening. There are benchmarks for operating systems, server software, cloud providers, network devices etc. Take a look here for a list of what they have to offer. SQL Server specific benchmarks can be found at https://www.cisecurity.org/benchmark/microsoft_sql_server/. There are some aspects of the site which requires membership but includes additional tools. Well worth the consideration.

National Vulnerability Database

The NCP is the U.S. government repository of publicly available security checklists which provide guidance on setting the security configuration of operating systems and applications. The checklists (STIG) can be downloaded as a zip. To view, download and install the STIG Viewer from https://public.cyber.mil/stigs/srg-stig-tools/ and follow the instructions.

How we can help

Security is constantly evolving. Setting up good policies around platform hardening, password complexity and rotation, and using accounts with the least privilege required is a daunting task for any organization. Especially those without dedicated security or database administrators. I’m hopeful a few of the resources above can get you started on the right path. We’re here to help as well. If you’d like assistance in assessing your SQL Servers, schedule a call with us here.

Thanks for reading!

The post Am I affected by MrbMiner malware? appeared first on The SERO Group.

Distributed Network Name access point

In SQL Server 2019 CU2 (or later) failover clustered instances, the listener was enhanced to work with the Windows Server Failover Cluster DNN access points. Prior to supporting DNN access points, a virtual IP access point was used but wasn’t supported in Azure without creating a load balancer. DNN access points reduce the complexity of FCIs in Azure by allowing the SQL client to connect without the need for a load balancer.

Create the cluster and failover clustered instance

Creating the cluster, using Azure Shared Disks, was covered in our previous post here. The difference is that we’re installing a SQL Server 2019 FCI and then applying CU 7 to ensure distributed network names are supported. Go ahead and create your Windows failover cluster and then create the SQL Server 2019 FCI. You won’t be able to connect to the FCI instance just yet because we’re not setting up an Azure load balancer. Failover the clustered role to all nodes within the cluster just to ensure there’s no issues.

Create the DNN

After the FCI has been created, we’ll need to rename the virtual network name resource. However, this isn’t required if you’re planning to use a different name for the DNN and access the instance using a different DNS name than you specified when setting up the FCI. I renamed mine to SEROSQLFC_VNN (shown below). To rename, right click on the Server Name resource in Failover Cluster Manager, and choose properties. I appended the existing name with “_VNN”. Don’t delete this resource as it is a required component of the FCI infastructure.

Next, create the DNN. I’ll be using SEROSQLFC to access the instance and used the powershell script below to create it.

Add-ClusterResource -Name SEROSQLFC_DNN -ResourceType "Distributed Network Name" -Group "SQL Server (MSSQLSERVER)"

Get-ClusterResource -Name SEROSQLFC_DNN | Set-ClusterParameter -Name DnsName -Value SEROSQLFC

Once created, you should see a new resource within the cluster role.

Bring the DNN online. The instance must be restarted before accessing. I typically failover to the other node, attempt to access the instance from a remote server using SSMS, and then failback to ensure the instance can be accessed when hosted on either node.

IP conflicts and how to avoid them

When using a distributed network name access point there’s no longer a load balancer reserving virtual IP address in Azure and there’s a risk that another resource on the virtual network will be assigned the same IP address as the virtual IP address used by the FCI. This can lead to an IP conflict. The powershell script below was used to create an APIPA address to avoid this issue. Another option is to create a dedicated network adapter in Azure and reserve the IP address used by the virtual IP address resource. Both of these options can be seen here.

Retrieve the virtual IP resource name by opening Failover Cluster Manager and right clicking on the IP address resource (example below). Choose properties and note the resource name.

Get-ClusterResource "SQL IP Address 1 (SEROSQLFC)" | Set-ClusterParameter –Multiple @{"Address”=”169.254.1.1”;”SubnetMask”=”255.255.0.0”;"OverrideAddressMatch"=1;”EnableDhcp”=0}

Take the IP Address resource offline and back online for the changes to take effect. This will also take SQL Server offline so these resources will need to be restarted as well.

Additional resources for Creating Failover Clustered Instances

Distributed network names and shared disks simplify the usage of FCIs in Azure. However, there a few issues to watch out for. This post is not meant to provide an in depth review but a quick overview of what is possible using these new features available in Azure, Windows OS (since 2016), and SQL Server 2019 (cu2 or later). The resources below provide additional detail on the use of DNNs.

FCI DNN & SQL Server features

Rename a SQL Server Failover Cluster Instance

Create DNN for FCI

Conclusion

Let us know your thoughts regarding this option for high availability and if it’s something you may be interested in leveraging in the future.

Thanks for reading!

The post How to Create SQL Server 2019 Failover Clustered Instances in Azure appeared first on The SERO Group.

The post Health innovations appeared first on The SERO Group.

The post Seasonal health tips appeared first on The SERO Group.

The post Alcohol and Drug Prevention appeared first on The SERO Group.

The post The public health appeared first on The SERO Group.

In football, the quarterback is the de facto leader of the offense of team. Late in the game it is to him that the team looks to snatch a last minute come-from-behind victory from certain defeat. That’s a lot of weight to put on one man’s shoulders.

Yet the quarterback is leading his team in more ways than one. Sure he calls the signals and distributes the ball to other players through hand-offs or passes. But it is his demeanor that sets the tone for the rest of the team.

If the quarterback is visibly frustrated, if he comes to the sideline throwing his helmet, if he blames others for mistakes, if he hangs his head in despair, the team becomes rattled and loses confidence.

On the other hand, if the QB is mindful of his attitude, if he is poised and confident in spite of adversity or mistakes, the team rallies around him and is motivated to perform at an elevated level.

The team will mirror the characteristics of its leader; it will perform only as well as its leader.

The same can be true in business. As the leader of your team, your direct reports will feed off of your attitude and demeanor. Keep that in mind the next time your team faces adversity.

So, how is your attitude? What tone are you setting for your team?

The post You’re Leading in More Ways appeared first on The SERO Group.

Series Outline

• So I Got Promoted, Now What?
• Stop Doing Your Old Job
• Employ the Same Successful Tactics
• Get to Know Your Peers
• Get a Trusted System
• Manage Your Email
• Manage Your Calendar
• Start Having Weekly One-On-Ones
• Recognize the Tendency to Revert

Your Hard Work Has Paid Off

You’ve work hard over the past few years, going the extra mile to make sure that everything in your charge has gone well. You’ve managed your individual and team projects well; you’ve organized your work and developed a personal discipline so that nothing has fallen through the cracks. And now your hard work has finally paid dividends. You’ ve been recognized with a promotion. So now what do you do?

This is a question that many highly skilled, highly technical people ask themselves once the euphoria of increased pay and acknowledgement has worn off.

Unfortunately, many don’t pursue the answer long enough to find it. Instead they get mired down into the daily routine of their new role and never explore how they could better prepare to succeed. Many languish in mediocrity at best, and fail at worst.

So what’s the first thing you need to do?

Stop Doing Your Old Job

Stop doing your old job. To many, this may sound too obvious to mention. If you are promoted to a new position, why would you want to continue doing your old job as well as the new one? Isn’t one job enough?

Unfortunately, in many cases it’s just not that discrete. Often the promotion is a “working promotion.” You’ve been promoted to Senior DBA, to Development Team Lead, to Manager of the Administration Team, or to Director of Operations. The promotion comes with a new title, an increase in pay, and some new responsibilities. However, you find that in addition to your new duties, you are still accountable for many of the same tasks you had before your promotion.

To be successful in your new role, you will need to approach it with the same fervor and dedication that led to your promotion. You won’t be able to do that if effectively if you are spending a significant amount of your time doing your old job. Something has to give and it had better be the old job.

“But, It’s Not My Job”

To be clear, I’m not advocating that you tell your boss “It’s not my job anymore.” when he asks you about something that was your direct responsibility prior to the promotion. They don’t want to hear that. And besides, unless your promotion has moved you to a completely new department, that task still falls under your purview. And it’ll remain your responsibility until you’re told specifically otherwise or your replacement can be found.

So, in order to stop doing your old job, you’ll need to identify people who can successfully step into the role you once occupied, or at least take on many of the responsibilities. This can be done through a series of progressively larger and more impacting steps: assign immediate tasks, delegate small projects, and create a growth plan for your team.

Assign Immediate Tasks

Many of us have daily, weekly, or even monthly tasks that require our time and attention. There are backups to verify, meetings to attend, status reports to create, numbers to run, and logs to review, to name but a few. None of these are particularly urgent. Many are not high profile. But all need to be done.

In your prior role, you probably handled each of these at part of your job. Those responsibilities were commiserate with your level. In your new role, however, many of those activities will drain one of the most precious resources you have: your time. If you can safely offload those discrete yet repetitive tasks to one or your team members, you’ll potential free several hours per week.

Delegate Small Projects

The next step is to begin delegating some of the projects for which you are responsible. Start small and work your way up. Don’t begin with a large, complex project with multiple moving parts requiring input from numerous colleagues. Start with a small, fairly self-contained project that can be accomplished without  much outside input. Expect to work closely with the team member to whom you’ve delegated the project.

Initially, delegating will not free up your time. On the contrary, it will likely consume more of your time in the short-term than if you just did it yourself. But the payoff is just around the corner, just a few months down the road. As you get better at delegating and your team learns how to run with the delegated projects, you’ll be able to do more and more. Delegation is a force multiplier once you pay the initial start up costs in time.

Create a Growth Plan for Your Team

The best people have a knack for bringing out the best in other people. They somehow get others to perform and exceed even their own expectations. You want those kind of people on your team. And if you want them on your team, you can bet that your boss wants them on his team, too.

One way to bring out the best in other people is to consciously and intentionally create a growth plan for each of them. Talk with them. Learn their aspirations. Discover their likes and dislikes. Create a plan to help  them grow professionally, technically, and interpersonally. In short, you’d eventually like for them to easily step into your shoes once you get promoted again.

Ifs, Ands, and Buts

But isn’t all this risky? Won’t one of your team members take your job? Or won’t they get promoted out from under you?

Fostering an environment where you can be more effective while growing your people is not “risky.” In fact, a good argument can be made for just the opposite. Not growing your team is risky. Creating an environment where personal growth is not evident, where the same old routine is done day in and day out, is far riskier to you than growing your team. The best people won’t want to stay in that environment. You’ll be left with the mediocre.

One of the best compliments you can be paid as a manager is to have one of your team members promoted to a new position. It’s speaks well of the environment you’ve created. And when that happens again and again, senior management will recognize your role in producing highly effective people.

And when you get promoted, you’re next transition will be easier because you’ll have already cultivated your replacement.

The post So I Got Promoted, Now What? Stop Doing Your Old Job appeared first on The SERO Group.