You have worked hard to protect your SQL Server and the databases it hosts. You have built barriers against SQL Injection, and limited the capabilities for database clients to the limited set of permissions required for the work they are responsible to accomplish. Isn’t that enough?
For some companies that may be adequate coverage. Remember, however, that it is estimated that a large majority of hacking comes from internal resources. If that is the case, then what other areas of attack are still open?
If you’re server allows for individuals with necessary rights, they can use any form of ad-hoc tool to exercise SQL Queries against your server and the database it hosts. A hacker who is able to establish credentials to your SQL Server with administrative rights can do just about anything. They may even be able to perform hacking against the server itself, depending on your configuration. They key to this problem is to not use Administrative credentials unless they are required for the work you are doing. Don’t log into you SQL Server as Administrator all the time to do maintenance tasks. By not using an Administrative login you reduce the exposure of your credentials to be captured by an undetected virus or sniffer of some sort.
A second area of vulnerability would be any database backups that may be accessed in some way. If you actually backup your databases to an external media, and send them offsite, it is possible that the database backups may be acquired and restored externally. There are so many different things you can do to protect your backups, including encryption, etc. Be sure to put effort into protecting any persisted instance of your database, be it a database file, transaction log, or backup. They are all readable.
Another area we don’t always remember is that data may still be accessible in decommissioned disks. When a data disk is retired, even if it is broken, be sure to destroy the contents of the disk. Just because the controller of a disk dies, and you replace it with a new disk, doesn’t mean someone can’t repair the controller on your disk, and recover data it contains. That data may not be in a very user friendly format, but that isn’t something that stops a motivated hacker.
Cheers,
Ben