DBPedias

Your Database Knowledge Community

Jonathan Gardner

  1. Securing SQL Server with Transparent Data Encryption (TDE)

    If it was not clear by my recent post Auditing SQL Server, I have compliance and security on my mind lately. This post is no different.

    While SQL Server has had encryption for some time, implementation takes significant planning and can require modification of application code. With SQL Server 2008, Microsoft introduced Transparent Data Encryption (TDE). This feature allows for encryption of the actual data and log files and any subsequent backups of those files. TDE avoids the need for application modification by performing the encryption and decryption in real time and at the database level.

    Note: TDE is an Enterprise Only feature

    Before covering how to enable TDE and encrypt the database, it needs to be noted that the certificate used to encrypt the database needs to be backed up and available in the event a recovery is necessary. This needs to be included in DR planning before TDE is enabled.

    The first step toward TDE is creation and subsequent backup of the Master Key.

    USE master
    GO
    --Create the Master Key Encryption
    CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'MyP@$$w0rd'
    GO
    --Backup the Master Key
    BACKUP MASTER KEY TO FILE = N'C:\SQLCertBackup\MasterKey'
        ENCRYPTION BY PASSWORD = 'MyP@$$w0rd'
    GO

    Once the Master Key has been created, the Server Certificate can be created. This certificate is stored in the master database.

    USE master
    GO
    --Create the Server Certifiacate
    CREATE CERTIFICATE MyServerCert WITH SUBJECT = 'My Certificate'
    GO
    --Backup the certificate
    BACKUP CERTIFICATE MyServerCert TO FILE = N'C:\SQLCertBackup\MyServerCert'
    GO

    With the Master Key and the Certificate created, the database is ready to be secured through the creation of the database encryption key. This key is secured by the certificate created above.

    --Create the Database Encryption Key
    USE AdventureWorks2012
    GO
    CREATE DATABASE ENCRYPTION KEY WITH ALGORITHM = AES_256 ENCRYPTION BY SERVER
        CERTIFICATE MyServerCert
    GO

    The final step is to actually enable encryption of the database.

    --Enable encryption on the database
    ALTER DATABASE AdventureWorks2012
    SET ENCRYPTION ON
    GO

    TDE and Performance

    Understanding that TDE works by encrypting and decrypting in realtime naturally leads to questions regarding performance. Microsoft BOL claims that it will only increase CPU utilization by 3-5%. Some independent testing by Rob Garrison seems to support Microsoft’s claim. You can check out his testing here.

    Additional items to consider when implementing TDE:

    • During the initial implementation of TDE, the entire database and log files will need to be encrypted. How long this will take is dependent upon many factors including size of the database and server specifications.
    • Enabling TDE on an instance will encrypt the tempdb for the entire instance.
    • Backup compression will not be as effective because encrypted data does not compress well.
    • FILESTREAM data is not encrypted using TDE.

    Conclusions

    TDE gives the DBA a way to secure the database without having to alter applications connecting to it. It is important to understand the effects before implementing. If applications connecting to the database already cause a heavy load on the CPU it is important to test how TDE will effect performance.

    If you are using TDE in production, I would love to hear about your experience in the comments below.

    Permalink | Leave a comment  »

  2. Administering Microsoft SQL Server 2012 Databases (71-462): Afterthoughts and Study Guide

    Inline image 1

    So this is the third of of the four SQL Server 2012 beta exams that I am taking.  I have blogged about my experiences with the other exams and shared the study notes that I have used.  This post is no different.  For more information no the other exams I have taken to date, see the links below. 

    Querying Microsoft SQL Server 2012 (71-461)
    Designing Database Solutions for Microsoft SQL Server 2012 (71-465)

    The exam was pretty good.  I have nit picky issues with the way some of the questions were worded but overall I felt the test did a good job of covering the material. 

    My study notes listed below are based off of the Microsoft Training Catalog.  You will not that I did not covey everything listed in the catalog.  I didn't have time to get it all listed out. 

    Install and Configure SQL Server (19%)
       * Plan installation
          * Evaluate Installation Requirements
          * Drive best practices
             * Disk configuration primer: http://www.mssqltips.com/sqlservertip/1328/hard-drive-configurations-for-sql-server/
          * Service Accounts
             * These should be Managed Service Accounts
       * Install SQL Server and related services
       * Implement a migration strategy
       * Configure additional SQL Server Components
          * Configure full-text indexing
             * allows for full-text queries against character based data
             * More information about configuring full-text indexing can be found here: http://msdn.microsoft.com/en-us/library/cc879306.aspx
          * Configure FILESTREAM
             * This can be done through the GUI or through TSQL and the sp_configure command
             * More information on FILESTREAM can be found here: http://msdn.microsoft.com/en-us/library/cc645923.aspx
          * Configure FileTable
             * FILESTREAM must be enabled to use FileTable
             * Enable Non-Transaction Access at the Database Level
             * Specify a directory for FileTables at the Database Level
             * More information on FileTable: http://msdn.microsoft.com/en-us/library/ff929068(v=sql.110).aspx
       * Manage SQL Server Agent
          * Create, maintain, and monitor jobs
             * More information on creating jobs: http://msdn.microsoft.com/en-us/library/ms190268.aspx
          * Monitor Jobs
             * Job activity can be viewed in the Job Activity Monitor
             * Job activity can also be queried by running the sp_help_jobactivity
             * More information can be found here: http://msdn.microsoft.com/en-us/library/ms187449.aspx
          * Administer jobs and alerts
             * An alert  is an automated response to an event
             * Alerts can respond to
                * SQL Server events
                * Performance conditions
                * Windows Management Instrumentation (WMI) events
                * More information on alerts can be found here: http://www.simple-talk.com/sql/database-administration/sql-server-alerts-soup-to-nuts/

    Maintain Instances and Database (17%)
       * Manage and configure databases
          * Filegroups
             * named collections of files and are used to help with data placement and administrative tasks such as backup and restore operations.
             * Log files are never part of a file group
             * More information regarding Filegroups can be found here: http://msdn.microsoft.com/en-us/library/ms179316.aspx
          * Database configuration
             * Five categories
                * Auto Options
                * Cursor Options
                * Recovery Options
                * SQL options
                * State options
             * More information on Database configuration options can be found here:http://msdn.microsoft.com/en-us/library/aa933082(v=sql.80).aspx
          * Transparent Data Encryption (TDE)
             * real-time I/O encryption and decryption of the data and log files
             * It does not provide encryption across communication channels
             * Encryption is performed at the page level.
             * More information regarding TDE can be found here: http://msdn.microsoft.com/en-us/library/bb934049.aspx
          * Database Console Commands DBCC
             * More information can be found here: http://msdn.microsoft.com/en-us/library/ms188796.aspx
          * Manage Log file growth
             * Information regarding managing the size of Transaction Log files can be found here: http://msdn.microsoft.com/en-us/library/ms365418.aspx
       * Configure SQL Server Instances
       * Implement a SQL Server clustered instance
          * More Information can be found here: http://msdn.microsoft.com/en-us/library/ms179530.aspx


    Optimize and Troubleshoot SQL Server (14%)
       * Identify and resolve concurrency problems
          * Deadlock Trace Flags
             * Profiler Trace Flags 1204 and 1222 return information that is captured in the error log
             * More information regarding Deadlocks can be found here: http://msdn.microsoft.com/en-us/library/ms178104.aspx
          * Reporting database infrastructure (replicated databases)
             * Transactional replication is typically the form used for data warehousing and reporting
             * More information can be found here: http://technet.microsoft.com/en-us/library/ms151198.aspx
          * Monitor via Dynamic Management Views
             * DMVs and DM Functions return server state information
             * More information regarding DMVs can be found here: http://technet.microsoft.com/en-us/library/ms188754.aspx
          * Diagnose Blocking
             * Information regarding blocking can be found here: http://sqlblog.com/blogs/adam_machanic/archive/2011/04/14/blocking-blockers-and-other-b-words-a-month-of-activity-monitoring-part-14-of-30.aspx
       * Collect and analyze troubleshooting data
          * Monitor using profiler
             * Profiler manages traces and allows for the replay of trace results
             * More Information on Profiler can be found here: http://msdn.microsoft.com/en-us/library/ms181091.aspx

    Permalink | Leave a comment  »

  3. Designing Database Solutions for Microsoft SQL Server 2012 (71-465) Afterthoughts and Study Notes

    Inline image 1

    I continue to take the SQL Server 2012 beta exams.  I have already taken Querying Microsoft SQL Server 2012.  I took the Designing Database Solutions for Microsoft SQL Server 2012 beta exam today.  My thought after finishing the exam is that I did well and the exam needs some work.  I started taking notes for the comments section and got to three pages of comments.

    I was frustrated quite a few questions that referenced SQL Azure when it was not mentioned at all in the skills measured.  While I understand that most of the fundamentals are the same, it needs to at least be mentioned in the info for the exam.

    You can still take the exams for free by following this link.

    I have kept my information in Evernote and you can see my notebook here.

    The notes below and in my notebook are based off of the study guide posted in the Microsoft Training Catalog.  You will note that I did not cover everything in the catalog.  I ran out of time studying.  So while incomplete, I hope it helps anyone looking for info on the exam. 

     This exam is intended for database professionals who design and build database solutions in an organization.  They are responsible for the creation of plans and designs for database structure, storage, objects, and servers.  They create the plan for the environment in which the database solution runs.  Primary responsibilities may include but are not limited to:

    Design Database Structure (29%)

    Design Database and Database Objectives (32%)

    • Design a database model
      • Design a logical schema
      • Design a normalized database
      • Design data access and data layer architecture
      • Relational Model
      • Normalized data model
      • Database schema
      • EAV modeling
      • Star-Schema
      • Collation
        • These are the rules that govern the use of characters for a language or alphabet.
      • ANSI NULLS
      • QUOTED IDENTIFIER
    • Design Tables

    Design Database Security (15%)

    • Design an application strategy to support security
      • Design security
      • Schemas and schema security
      • SQL Server vs. Integrated Authentication
        • Integrated authentication leverages the Windows principal token in the operating system.
          • This uses Kerberos security protocol
          • Complexity requirements and account management is in a central location
        • SQL Server Authentication cannot use Kerberos security protocol
          • Is good for mixed environments that don't support windows auth.
        • More information regarding SQL Server authentication can be found here: http://msdn.microsoft.com/en-us/library/ms144284.aspx
      • Permissions and mirroring issues
        • If both SQL servers in a mirroring scenario do not run under the same service account the service account for each server will need to be manually added to all the servers in the scenario.
        • More information regarding logins and mirroring can be found here: http://technet.microsoft.com/en-us/library/ms366346.aspx
      • Encryption

    Permalink | Leave a comment  »

  4. Querying Microsoft SQL Server 2012 (71-461) Afterthoughts and Study Notes

    6835658072_1e5c03b78a

    I have just finished the first of the Microsoft SQL Server 2012 Beta exams, Querying Microsoft SQL Server 2012 (71-461).  I took them for a couple of different reasons, I feel that certifications are important and it was an opportunity for me to upgrade my current certifications.  

    My thoughts after finishing the exam, You don't want me to be your developer.  It was a good exam by I know my strengths are in database administration and not development.  There were some questions that were unclear, and some that I flat didn't know the answer of but they seemed positioned simlar to the tests from last year.  

    If you are intersted in taking these exams you can register for them for free here.

    I have mentioned before that use Evernote for a host of things.  Studying for these exams has been no different.  I have created a notebook that has my links to study notes.  I am going to post them here but I will share the notebook that will update as I update them.  You can see the notebook here.

    The notes below and in my notebook are based off of the study guide posted in the Microsoft Training Catalog.

    This exam is intended for SQL Server database administrators, implementers, system engineers, and developers with two or more years of experience who are seeking to prove their skills and knowledge in writing queries. Primary responsibilities may include but are not limited to:

    Create database objects (24%)

    Work with Data (27%)

    • Query and manage XML data

    Modify Data (24%)

    • Create and alter stored procedures
    • Modify data by using INSERT, UPDATE, and DELETE statement
    • Combine Datasets
      • Datasets can be combined by UNION, EXCEPT, and INTERSECT
      • ORDER BY is only allowed at the end of the statement and cannot be used within the individual queries
      • GROUP BY and HAVING clauses can be used only within individual queries not on the final result set.
      • The FOR BROWSE clause cannot be used.
      • MSDN Library Reference: http://msdn.microsoft.com/en-us/library/ms191523.aspx
    • Work with functions

    Troubleshoot and Optimize Queries (25%)

     

     

     

     

    Create and alter indexes

    • Index allows specific data to be located quicker.
    • Indexes are on-disk structure associated with a table or view.
    • There are two types of indexes: Clustered and Nonclustered
      • Clustered
        • Sort and store the data rows in the table. 
        • Like 'The Highlander', there can be only one
      • Nonclustered
        • Contains key values and a pointer to the data roy that contains the key
        • Can have more than one.
    • Indexes, if properly designed, can reduce disk I/O and improve system performance by reducing the use of system resources. 
    • CREATE INDEX TSQL can be found here: http://msdn.microsoft.com/en-us/library/ms188783.aspx

    Create and alter stored procedures

    Create and alter user-defined functions (UDFs)

     

    Enhanced by Zemanta

    Permalink | Leave a comment  »

  5. Houston User Group Casino Night

    Post image for Houston User Group Casino Night

    The Houston SharePoint User group reached out to other area user groups this year and asked if we would like to participate in a joint user group event around Christmas time. We, of course, thought this was a fantastic idea. What is better than having community get together? Having multiple communities get together for a great event. Thus the joint Casino Night was born.

    When: Wednesday, December 14th, 2011

    Where:Norris Conference Center, Red Oak Ballroom

    Registration: Link

    Special Notes

    The registration email contained some special restrictions. Please see below:

    Special restrictions may apply, some offers not valid in all states, see in-store for details, this offer not valid in Iceland or the Turkish Islands, no purchase necessary when purchasing, if you experience certain conditions longer than 5 to 6 six hours please see your doctor.

    Special Thanks

    While I was not involved with sponsorship for this event Red Gate reached out to the community looking for special events at the end of the year. I responded with information for the event and they loved the idea. They loved it to the point that they helped sponsor the event. Just another reason I love being a part of the SQL Community.

    Red-Gate Logo

  6. Speaking at SQL Saturday #97

    Post image for Speaking at SQL Saturday #97

    I have been selected to speak at SQL Saturday #97 in Austin, TX on October 1st.  I will be presenting a bonus topic, Adventures in Project Management.

    I am very much looking forward to presenting is Austin.  Reviewing the lineup, it will be an event not to be missed.  Some of my favorite people will be there: AJ Mendo (Blog | Twitter), Ryan Adams (Blog | Twitter), Joe Celko  just to name a few.  Wes Brown (Blog | Twitter) and his leadership team are shaping up a great event.  Don’t miss out, get registered today.

    Adventures in Project Management Synopsis

    Join Jonathan Gardner in a discussion about the project management and how understanding the process can increase the chances of delivering a top quality work product.  Learn the questions to ask that will help prevent scope creep and manage stakeholders from a PMI certified Project Manager.

  7. SQLSaturday #57, Houston

    Post image for SQLSaturday #57, Houston

    As Cochair of the planning committee I am very pleased to announce that we are officially having a SQLSaturday in Houston. The event will be on January 29th, 2011 at the Bammel Church of Christ.

    Co Chairs

    Jonathan Gardner (Blog|Twitter)

    Malik Al-Amin (Blog|Twitter)

    Nancy Hidy Wilson (Twitter)

    Information

    We have created a Twitter account @SQLSatHou to distribute information. Please use the hastag #SQLSat57 when discussing the event and it will show up on the official SQLSaturday site.

    The official SQLSaturday #57, Houston website is here.

    Volunteers

    We are always looking for people to help out. On the registration page there is a section to volunteer. I would highly encourage everyone to do this. While my motives are a bit selfish, it is really a great way to network with other volunteers and give back. If that is not enough, check out David’s Post on Five Reasons You Should Volunteer with Your Local SQL User Group and Host a SQL Saturday

    Hope to see you there!

  8. SQLSaturday #35 Recap

    This weekend I was in Dallas, TX with Nancy Wilson (Twitter) and Malik Al-Amin (Twitter) form the Houston Area SQL Server Users Group volunteering at SQLSaturday 35. It gave us a unique perspective and taught us some very valuable lessons for when we put on SQLSaturday in Houston.

    I wanted to give a big thanks to the North Texas SQL Server Users Group, all of the presenters, and volunteers to helped make this event a success. The general consensus that I heard was that everyone took something away from the event that they were going to be able to use.

    Denny Cherry (Blog|Twitter) had a great write up about SQL Saturday #33. I am going to follow a similar format for this post.

    The Good

    Size

    I was surprised by the number of people that were registered to attend. 500 people were registered and there was a wait list for the event. The event was limited to 500 people because that would exceed the fire code for the building. In the end, everyone who showed up was able to get into the event. I don’t know the official attendance number but the last number I heard was near 400. There were 42 sessions across 7 rooms with some extra sponsor sessions held during the lunch break.

    Food

    I ate breakfast at the hotel as I didn’t know that there was going to be breakfast at the event. I didn’t see it mentioned but to be honest that may have been an err on my part. I didn’t read all of the latest event communication so there is a large possibility that I missed the announcement. I didn’t hear anyone complaining about the food, especially with the line for Paciugo Gelato wrapping around the entire building.

    Location

    SQLSaturday 35 was held at the Region 10 Education Services Center in Richardson, TX. It turned out to be a great place to hold SQLSaturday as it was designed for just such a training event. As a matter of fact, the I like it so much I am going to contact the Region 4 Education Services Center in Houston to see if we can hold a SQL Saturday there soon.

    The hotel was very close to the event, approximately 2 blocks. This would be just a short walk, but with temperatures over 90 degrees I don’t think anyone did. I did not hear of anyone that attended the event from out of town say that they were staying somewhere else. What I did hear is that some people, including me, tried to check into the wrong hotel as there are two Courtyard by Marriott locations in Richardson. Instead of looking at my confirmation I relied on Google Maps to tell me where to go. Google Maps #fail.

    The Could be Better

    The Raffle

    The prizes that were give away were fantastic. It was no secret that I wanted the iPad that was being raffled off, I wanted it bad. Execution of raffles can be problematic. The prizes displayed/discussed, the number drawn, and the recipient then had to come down to the same person that called the number out to claim their prize all while the audience clapped after every drawing. This causes prize distribution to be lengthy, hence the creation of the t-shirt canon.

    I am not suggesting I have ultimate raffle solution but some great ideas were thrown around at the after party that may have merit for further evaluation.

    The After Party

    The location for the after party was at the same location as the speaker’s dinner the night before. The room was partitioned off from the rest of the building so it was essentially a private room just for us. There was really no advertising of the after party until the raffle at the end of the day when everyone was trying to file out of the room.

    The after party can be the most valuable of the entire event. The after party is where attendees can network and talk with the speakers and volunteers, many times in a one on one conversation. Advertisement of the after party should have been throughout the course of the event.

    Overall

    I would say that this event was a huge success. The issues mentioned above are really secondary to the main goal of providing a day of SQL training. The team from the North Texas SQL Server Users Group really did a fantastic job putting on the event and I am looking forward to attending again when they have the next one.

    I am working with Malik Al-Amin (Twitter) to put on a SQL Saturday in Houston. You can follow either of us on Twitter for more details or you can follow the Twitter account that I have set up for the event SQLSatHou.

    Find a SQL Saturday event near you and get involved with your local user groups.

  9. Using Model to Change Default Database Settings



    During a Twitter conversation today Malik Alamin (Twitter) asked about the Autogrow settings on his databases. The conversation naturally progressed to the question of how you change the default behavior and set all newly created databases to have user defined settings. Brent Ozar (Blog | Twitter) was able to point us in the right direction to find a solution.  Modifying the model database.

    About the model Database

    When a new database is created either by using the CREATE DATABASE statement, that mean via SSMS as well, the model database is used as a template. This means that change made to the model database settings, including tables, permissions, stored procedures, and functions will all transfer over to the newly created database.

    According to the TechNet article about the model database some file sizes may look different depending on what version of SQL Server is installed.  Also, there are some things that cannot be modified in the model database. Items like CHANGE_TRACKING, ENCRYPTION, and TRUSTWORTY cannot be modified. A full list of restrictions can be found in the TechNet Article.

    Example

    I need to set the auto grow on my data file to Autogrow by 10% instead of 1 MB as was the default on my instance. I can run the ALTER DATABASE command or use SSMS against the model database

    USE [master]
    GO
    ALTER DATABASE [model] MODIFY FILE ( NAME = N’modeldev’, FILEGROWTH = 10%)
    GO
    USE [master]
    GO
    ALTER DATABASE [model] MODIFY FILE ( NAME = N’modeldev’, FILEGROWTH = 10%)
    GO

    Making these changes will alter all newly created databases to have the same settings.

    Note: Jorge Segarra (Blog | Twitter) pointed out that this does NOT work in a SharePoint environment.  SharePoint does not use the model database when it creates new site databases.

  10. Houston Area SQL Server User Group Meeting



    This is a reminder that we will have Kevin Kline (Blog | Twitter) with us discussing Top 10 Mistakes on SQL Server. I would encourage everyone in the area to come out if they can. Detailed meeting information below:

    When: Tuesday, April 13, 2010 – 11:30am-1:00pm
    Where: Microsoft Houston Office
    2000 W. Sam Houston Pkwy. S. #350
    Houston, Texas 77042-3615
    Pizza and drinks provided by Idera.

    LiveMeeting Link
    Conference Call for audio – 1-888-320-3585 (passcode 76027128)

    Topic: Top 10 Mistakes on SQL Server
    Speaker: Kevin Kline, Technical Strategy Manager, Quest; Immediate Past President of PASS (blog | twitter)

    If you are planning to attend in person, please RSVP to (Nancy.Wilson @ sqlpass.org) by Monday, April 12.



  1. 1
  2. Next ›
  3. Last »