SQL Server Security Enhancements

It has been approximately 10 years since Microsoft initiated its trustworthy computing initiative. Since then, SQL Server has had the best track record with the least amount of vulnerabilities and exposures among the major database players in the industry. The graph shown in Figure 1-6 is from the National Institute of Standards and Technology (Source: ITIC 2011: SQL Server Delivers Industry-Leading Security). It shows common vulnerabilities and exposures reported from January 2002 to June 2010. With SQL Server 2012, the product continues to expand on this solid foundation to deliver enhanced security and compliance within the database platform. For detailed information
of all the security enhancements associated with the Database Engine “ Security Enhancements.” For now, here is a snapshot of some of the new enterprise-ready security capabilities and controls that enable organizations to meet strict compliance policies and regulations:User-defined server roles for easier separation of duties

• Audit enhancements to improve compliance and resiliency

• Simplified security management, with a default schema for groups

• Contained Database Authentication, which provides database authentication that uses self-contained access information without the need for server logins

• SharePoint and Active Directory security models for higher data security in end-user reports

Programmability Enhancements
There has also been a tremendous investment in SQL Server 2012 regarding programmability.
Specifically, there is support for “beyond relational” elements such as XML, Spatial, Documents, Digital Media, Scientific Records, factoids, and other unstructured data types. Why such investments? Organizations have demanded they be given a way to reduce the costs associated with managing both structured and nonstructured data. They wanted to simplify the development of applications over all data, and they wanted the management and search capabilities for all data improved. Take a minute to review some of the SQL Server 2012 investments that positively impact programmability. For more information associated with programmability and beyond relational elements.

• FileTable Applications typically store data within a relational database engine; however, a myriad of applications also maintain the data in unstructured formats, such as documents, media files, and XML. Unstructured data usually resides on a file server and not directly in a relational database such as SQL Server. As you can imagine, it becomes challenging for organizations to not only manage their structured and unstructured data across these disparate systems, but to also keep them in sync. FileTable, a new capability in SQL Server 2012, addresses these challenges. It builds on FILESTREAM technology that was first introduced with SQL Server 2008. FileTable offers organizations Windows file namespace support and application compatibility with the file data stored in SQL Server. As an added bonus, when applications are allowed to integrate storage and data management within SQL Server, fulltext and semantic search is achievable over unstructured and structured data.

• Statistical Semantic Search By introducing new semantic search functionality, SQL Server 2012 allows organizations to achieve deeper insight into unstructured data stored within the Database Engine. Three new Transact-SQL rowset functions were introduced to query not only the words in a document, but also the meaning of the document.

• Full-Text Search Enhancements Full-text search in SQL Server 2012 offers better query performance and scale. It also introduces property-scoped searching functionality, which allows organizations the ability to search properties such as Author and Title without the need for developers to maintain file properties in a separate database. Developers can now also benefit by customizing proximity search by using the new NEAR operator that allows them to specify the maximum number of non-search terms that separate the first and last search terms in a match.

• Extended Events Enhancements This new user interface was introduced to help simplify the management associated with extended events. New extended events for functional and performance troubleshooting were also introduced in SQL Server 2012.