Security in Sql Server
SQL Server 2005 has met the comprehensive requirements for the Common Criteria evaluation program and been accepted as of January 2006. This is one of the most recognized industry-wide certifications for database products.
Have a look at some of the new security features in SQL 2005.
https://www.microsoft.com/sql/technologies/security/security-at-a-glance.mspx
From an architectural perspective, SQL Server 2005 differentiates between user and schema (unlike SQL 2000). This is an important distinction and provides more granular security control. Also, now you can encrypt the data in your database using a certificate or an encryption algorithm. These, and many other features, have been discussed at length in this article.
SQL Server also has many components like Integration Services, SQLCLR etc. and there are special considerations that apply to their security. Refer to this great resource on MSDN that has subsequent links for security of each component.
https://msdn2.microsoft.com/en-US/library/ms161948.aspx
Microsoft Baseline Security Analyzer
Microsoft Baseline Security Analyzer (MBSA) is an easy-to-use tool designed for the IT professional that helps small- and medium-sized businesses determine their security state in accordance with Microsoft security recommendations and offers specific remediation guidance. Improve your security management process by using MBSA to detect common security misconfigurations and missing security updates on your computer systems.
https://www.microsoft.com/technet/security/tools/mbsahome.mspx
WEBCASTS
Microsoft has also published a host of webcasts on SQL Server security that not only cover the basics of security, but also provide best practices recommendations for real world scenarios.
Security Best Practices: Hardening Your SQL Server
SQL Server 2005 Essentials: Security Enhancements
SQL Server 2005 Series (Part 5 of 10): Protecting Sensitive Data
CASE STUDIES
At Microsoft, majority of our mission critical applications run against SQL 2005. Our internal IT division has implemented some of the largest payroll, sales, ERP applications in-house and have come up with home grown security best practices.
Here is a webcast that talks about how Microsoft IT manages security and encryption using SQL Servers databases. A must read.
SQL 2005 Security Overview for Administrators - Whitepaper
https://download.microsoft.com/download/4/7/a/47a548b9-249e-484c-abd7-29f31282b04d/SQLSecurityOverviewforAdmins.doc
Encryption features in SQL Server 2005 - Whitepaper
https://download.microsoft.com/download/4/7/a/47a548b9-249e-484c-abd7-29f31282b04d/SQLEncryption.doc
SQL Server 2005 Security Best Practices: Operational and Administrative Tasks - Whitepaper
https://download.microsoft.com/download/8/5/e/85eea4fa-b3bb-4426-97d0-7f7151b2011c/SQL2005SecBestPract.doc
How to make unwanted access to SQL Server 2005 by an operating system administrator more difficult
https://support.microsoft.com/kb/932881
Encrypting Connections to SQL Server
https://msdn.microsoft.com/en-us/library/ms189067.aspx
User-Schema Separation
https://msdn.microsoft.com/en-us/library/ms190387.aspx
Permissions Hierarchy
https://msdn.microsoft.com/en-us/library/ms191465.aspx
Security Catalog Views
https://msdn.microsoft.com/en-us/library/ms178542.aspx
Security Stored Procedures
https://msdn.microsoft.com/en-us/library/ms182795.aspx
Security Functions
https://msdn.microsoft.com/en-us/library/ms186236.aspx
Principals
https://msdn.microsoft.com/en-us/library/ms181127.aspx
Securables
https://msdn.microsoft.com/en-us/library/ms190401.aspx
Permissions
https://msdn.microsoft.com/en-us/library/ms191291.aspx
Server-Level Roles
https://msdn.microsoft.com/en-us/library/ms188659.aspx
Database-Level Roles
https://msdn.microsoft.com/en-us/library/ms189121.aspx
Application Roles
https://msdn.microsoft.com/en-us/library/ms190998.aspx
Permissions of Fixed Server Roles
https://msdn.microsoft.com/en-us/library/ms175892.aspx
Permissions of Fixed Database Roles
https://msdn.microsoft.com/en-us/library/ms189612.aspx
Authorization and Permissions in SQL Server
https://msdn.microsoft.com/en-us/library/bb669084.aspx
Context Switching
https://msdn.microsoft.com/en-us/library/ms191296.aspx
EXECUTE AS vs. SETUSER
https://msdn.microsoft.com/en-us/library/ms188315.aspx
How to add a Windows user to the sysadmin fixed server role