Attack surface

As explained in 100 SQL Server Mistakes and How to Avoid Them

An attack surface is the collection of system components and exposed capabilities that could be targeted to compromise a system.

An attack surface is the set of components and exposed capabilities that could be targeted to compromise a system. In SQL Server installation, unnecessary operating-system components, services, and features enlarge that surface. section 8.4 section 8.7

Two installation mistakes make the attack surface larger than necessary:

• Mistake #36: installing Desktop Experience because developers use Visual Studio. Server Core removes the GUI, reduces running components and services, and is suitable for SQL Server; Visual Studio should run on developer workstations or, when necessary, development servers. section 8.4
• Mistake #39: installing every SQL Server feature. Extra services consume resources, require patching, and may provide a path to lateral access if exploited. Install only required features—the YAGNI principle applies to server configuration. section 8.7

A safer SQL Server deployment

A team builds a SQL Server 2022 instance on Windows Server 2022 and selects Desktop Experience because SSIS developers use Visual Studio. A safer design keeps Visual Studio on developer workstations, administers a production server with Server Core, and installs only the SQL Server features the workload requires. section 8.4 section 8.7

Figure 8.2 Decision tree including Server Core

Use the decision tree to compare Server Core with Desktop Experience when choosing the operating-system installation. section 8.4

How 100 SQL Server Mistakes and How to Avoid Them covers it

How deep it goes

Explains operational causes and consequences of exposure, but stops short of formal threat modeling or vulnerability assessment.

Examples

Uses Windows Server 2022, SQL Server 2022, SSIS, Visual Studio, and optional SQL Server services as concrete cases.

What you can do after

Operate/configure SQL Server installations by choosing Server Core where suitable and excluding unneeded features and services.

How it connects

Connects Server Core, Desktop Experience, SQL Server features, services, patching, and lateral movement.

liveBookmanning.com

Read 100 SQL Server Mistakes and How to Avoid Them on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Secure APIsAn attack surface is the collection of exposed interfaces, components, and entry points through which an attacker may affect a system.
• 

  liveBookmanning.com
  Think Like a CTOThe complete set of points, interfaces, systems, and pathways through which an attacker could compromise or leak organizational assets.
• 

  liveBookmanning.com
  Data Pipelines with Apache Airflow, Second EditionAn attack surface is the collection of possible points through which an attacker could attempt to gain unauthorized access to a system.

Compare how 4 books explain attack surface →

Related concepts

• deployment pipelineproduced by · A sequence of automated or manual stages that builds, tests or validates, packages, and delivers software or models toward deployment.
• digital twinproduced by · A digital twin is a computational representation of a physical entity, process, or system that models relevant characteristics, state, or behavior.
• security hardeningaddressed by · Security hardening is the practice of reducing a system’s vulnerabilities and attack surface through secure configuration, protective controls, and removal of unnecessary functionality.
• dependencyproduced by · A software dependency is a component, resource, or prerequisite on which another software component or operation relies to function or proceed.

This explainer was generated by Manning's knowledge graph from the text of 100 SQL Server Mistakes and How to Avoid Them. The section links point to the parts of the book it draws on.