Back in the day… standard advice was to get that SQL Server off the Internet, public-facing access, if at all possible. Sometimes this worked, sometimes it didn’t because of application access and other issues with moving it to a private segment.
But the key is to remove those sensitive layers of access to SQL Server – control the surface area available to attackers to add more and more layers of support for access controls. This is still true today – and may be something that is less obvious or certainly can be more difficult to administer than it may seem.
If you’re using a hybrid cloud/on-premises system and have your applications talking across those borders to your SQL Server, be it an instance in the cloud, a managed service or locally managed system, the quickest route to getting that SQL Server accessible is often to make it more generally accessible.
That’s a long-winded way of saying, it’s easy to just hang it out on the Internet so it’s easy to get to for your applications.
But that’s a bad choice. It’s bad because you’ve just increased that attack surface area in a big way. Your SQL Server can become discoverable, it can be accessed for brute-force attacks and generally, the fact that it exists can be a real bit of bait for bad actors. It’s best to try to avoid this – that old advise still stands.
If you’re using cloud-based solutions (or hybrid) try moving that server behind the virtual private networks, behind the firewall, whatever tools you may have. This might mean a VPN connection between network segments, or might mean other means of having a secure, private connection.
It can also make connecting and administering and all of that more of a pain – so be aware of the complications for access. Things like bastion servers and software VPN connections and such can come in handy, depending on your configuration, requirements and access to the technology to make it happen. You may also have to review and update your web-based applications and the access paths they have to the data in your systems.
It’s most certainly worth it though, and every single thing you can do to limit access, control that surface area, and secure your SQL Server is key. It’s just too important to drop the server on the Internet because of infrastructure complications of the cloud (yes, I’ve actually been told that). It’s important to push back and do the right thing. At the very least, behind a firewall, you can control those systems that can access it by IP or other means. Basically cloak the server, protect it in all ways that you are able.
So, the old advise about keeping it off the public, unprotected internet and relying on user names and passwords for security still stands. Help out your SQL Server, give it the protection your data needs.