github/sql-server-samples
1
0
Fork 0
mirror of https://github.com/Microsoft/sql-server-samples.git synced 2025-12-08 14:58:54 +00:00
Code Issues Releases Wiki Activity

Update Demo Description

Browse Source
This commit is contained in:
Pieter
2022-12-01 16:23:36 +01:00
parent b1dd92c285
commit 31fedf95af
2 changed files with 30 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files
samples/features/security/ledger/sql-server/README.md
+8 -8
View File
@@ -55,7 +55,7 @@ You also need to make sure the following software is installed on your machine:
### Web Application
1. Open Visual Studio
1. Open the folder [WorldCup](../WorldCup)
1. Open the folder [WorldCup](../source/WorldCup/)
1. Click on the file Program.cs in the Explorer and go to line 25
1. Change the *Server* parameter in the connection string to the name of your SQL Server Instance.
1. Save your modifications.
@@ -79,12 +79,12 @@ Perform the below steps before you show the demo.
1. Connect to the database
1. Start the Azure Data Studio.
1. Open the Notebook [Ledger - World Cup Demo - SQL Server 2022](../tsql-scripts/Ledger%20-%20World%20Cup%20Demo%20-%20SQL%20Server%202022.ipynb)
1. Open the Notebook [Ledger - World Cup Demo - SQL Server 2022](../sql-server/tsql-scripts/Ledger%20-%20World%20Cup%20Demo%20-%20SQL%20Server%202022.ipynb)
1. Attach the Notebook to the SQL Server Instance and WorldCup database you have created during the demo Setup.
1. Prepare a browser window .
1. Open Visual Studio
1. Open the folder [WorldCup](../WorldCup)
1. Open the folder WorldCup](../source/WorldCup/)
1. Go to the top menu and click *Terminal - New Terminal*
1. In the terminal window type *dotnet run*. This will launch the web application.
1. Open your browser and enter the following URL *http://localhost:3000*
@@ -96,7 +96,7 @@ Perform the below steps before you show the demo.
1. Show the app and the database.
1. Show the Contoso World Cup web app in the browser. Explain that this is a list of all the soccer games. Show that you are logged in as Pieter (the DBA of the company) and place a bet.
![Place Bet](../../../../../media/features/ledger/Place-Bet.png)
1. Once you have placed the bet, show that the user can download a cryptographic receipt that proves the bet. This receipt could also be used to verify the database afterwards but is not part of this demo.
1. Once you have placed the bet, show that the user can download a cryptographic receipt that proves the bet. This receipt could also be used to verify the database afterwards but this is not part of the demo.
![Download Cryptographic Receipt](../../../../../media/features/ledger/Download-Receipt.png)
1. Go to the Notebook and show the 2 tables, Moneyline and bets in the Explorer. Explain that Moneyline table is an updatable ledger table and bets an append-only ledger table.
![Ledger Tables](../../../../../media/features/ledger/Ledger-Tables.png)
@@ -104,14 +104,14 @@ Perform the below steps before you show the demo.
1. Show how ledger captures history information in the updatable ledger table
1. Pieter has been asked to change the Home Country Odds for the game with ID 1. Run `code cell 2` in the Notebook to update the record.
1. Run `code cell 3` in the Notebook to show the history of the updated record. Explain that updates are stored as 2 records. A delete of the old version and an insert of the new version of the row.
1. Run `code cell 3` in the Notebook to show the history of the updated record. Explain that updates are stored as 2 records in the history table. A delete of the old version and an insert of the new version of the row.
1. Show how append-only ledger table works and how ledger helps investigate tampering by DBAs.
1. Michael, who is an internal auditor, performs a routine review of changes in the Worldcup database. As his first step, Michael runs the ledger verification to be sure he can trust the data he’s going to examine. Run `code cell 4` to execute the verification stored procedure. The result should be "Success"!
1. Michael, who is an internal auditor, performs a routine review of changes in the Worldcup database. As his first step, Michael runs the ledger verification to be sure he can trust the data he’s going to examine. Run `code cell 4` to execute the verification stored procedure. The result should be "Ledger verification succeeded."
1. Pieter wants to maliciously increase his payout for the game he betted on. Run `code cell 5 and 6` to try to update the record. Explain that update on an append-only ledger table is blocked.
1. Pieter thinks he's smart and tampers with the data directly into the data file by using a stored procedure. Do not run `code cell 7` because the stored procedure does not exists.
1. Michael, reviews the Worldcup database again after the tournament is over. He noticed that the verification procedure failed. Observe the results of code cell 8 to see evidence of tampering in a database ledger. **DO NOT RUN** the cell just review the pre-run results to see tampering in action.
1. Review the history of the transaction and show to the audience that you can verify which transactions cannot be trusted. **DO NOT RUN** the cell just review the pre-run results.
1. Michael, reviews the Worldcup database again after the tournament is over. He noticed that the verification procedure failed. Observe the results of `code cell 8` to see evidence of tampering in a database ledger. **DO NOT RUN** the cell just review the pre-run results to see tampering in action.
1. Review the history of the transaction and show to the audience that you can verify which transactions cannot be trusted. Observe the results of `code cell 9` but **DO NOT RUN** the cell just review the pre-run results.
## Key Takeaways
samples/features/security/ledger/sql-server/tsql-scripts/Ledger - World Cup Demo - SQL Server 2022.ipynb
+22 -104
View File
@@ -81,7 +81,7 @@
"azdata_cell_guid": "f75156e5-6996-4c40-9176-069f1b6ae1c0"
},
"outputs": [],
"execution_count": 39
"execution_count": null
},
{
"cell_type": "code",
@@ -108,7 +108,7 @@
"azdata_cell_guid": "4ae7db74-7c44-4c83-b667-adfa1b77a8f3"
},
"outputs": [],
"execution_count": 40
"execution_count": null
},
{
"cell_type": "markdown",
@@ -193,85 +193,8 @@
"tags": [],
"language": "sql"
},
"outputs": [
{
"output_type": "display_data",
"data": {
"text/html": "Commands completed successfully."
},
"metadata": {}
},
{
"output_type": "display_data",
"data": {
"text/html": "(1 row affected)"
},
"metadata": {}
},
{
"output_type": "display_data",
"data": {
"text/html": "Total execution time: 00:00:00.144"
},
"metadata": {}
},
{
"output_type": "execute_result",
"metadata": {},
"execution_count": 1,
"data": {
"application/vnd.dataresource+json": {
"schema": {
"fields": [
{
"name": "BetID"
},
{
"name": "MoneylineID"
},
{
"name": "FirstName"
},
{
"name": "LastName"
},
{
"name": "Country"
},
{
"name": "Bet"
},
{
"name": "Payout"
},
{
"name": "BetDateTime"
}
]
},
"data": [
{
"0": "6",
"1": "12",
"2": "Pieter",
"3": "Vanhove",
"4": "Belgium",
"5": "300.00",
"6": "-1400.00",
"7": "2022-12-01 13:21:28.5000000"
}
]
},
"text/html": [
"<table>",
"<tr><th>BetID</th><th>MoneylineID</th><th>FirstName</th><th>LastName</th><th>Country</th><th>Bet</th><th>Payout</th><th>BetDateTime</th></tr>",
"<tr><td>6</td><td>12</td><td>Pieter</td><td>Vanhove</td><td>Belgium</td><td>300.00</td><td>-1400.00</td><td>2022-12-01 13:21:28.5000000</td></tr>",
"</table>"
]
}
}
],
"execution_count": 1
"outputs": [],
"execution_count": null
},
{
"cell_type": "code",
@@ -362,7 +285,7 @@
"outputs": [
{
"output_type": "error",
"evalue": "Msg 37371, Level 16, State 1, Procedure sys.sp_verify_database_ledger_from_digest_storage, Line 1\r\nThe computed hash from 'Bets' and the associated history table does not match the hash persisted in sys.database_ledger_transactions for transaction 1466.",
"evalue": "Msg 37371, Level 16, State 1, Procedure sys.sp_verify_database_ledger_from_digest_storage, Line 1\r\nThe computed hash from 'Bets' and the associated history table does not match the hash persisted in sys.database_ledger_transactions for transaction 1004.",
"ename": "",
"traceback": []
},
@@ -375,12 +298,12 @@
{
"output_type": "display_data",
"data": {
"text/html": "Total execution time: 00:00:00.474"
"text/html": "Total execution time: 00:00:00.585"
},
"metadata": {}
}
],
"execution_count": 4
"execution_count": 3
},
{
"cell_type": "markdown",
@@ -397,7 +320,6 @@
"source": [
"SELECT\r\n",
" t.[commit_time] AS [CommitTime] \r\n",
"\t, t.[principal_name] AS [UserName]\r\n",
" ,l.[MoneylineID]\r\n",
" ,l.[FirstName]\r\n",
" ,l.[LastName]\r\n",
@@ -409,7 +331,7 @@
"\tFROM [dbo].[Bets_Ledger] l\r\n",
"\tJOIN [sys].[database_ledger_transactions] t\r\n",
"\tON t.[transaction_id] = l.[ledger_transaction_id]\r\n",
"\tWHERE t.transaction_id=1466;"
"\tWHERE t.transaction_id=1004;"
],
"metadata": {
"azdata_cell_guid": "d3bf1ca4-c66f-4ba8-a863-0811e120de51",
@@ -426,14 +348,14 @@
{
"output_type": "display_data",
"data": {
"text/html": "Total execution time: 00:00:00.033"
"text/html": "Total execution time: 00:00:00.042"
},
"metadata": {}
},
{
"output_type": "execute_result",
"metadata": {},
"execution_count": 5,
"execution_count": 4,
"data": {
"application/vnd.dataresource+json": {
"schema": {
@@ -441,9 +363,6 @@
{
"name": "CommitTime"
},
{
"name": "UserName"
},
{
"name": "MoneylineID"
},
@@ -472,29 +391,28 @@
},
"data": [
{
"0": "2022-12-01 13:21:28.5033333",
"1": "EUROPE\\pivanho",
"2": "12",
"3": "Pieter",
"4": "Vanhove",
"5": "Belgium",
"6": "300.00",
"7": "-10000.00",
"8": "2022-12-01 13:21:28.5000000",
"9": "INSERT"
"0": "2022-12-01 16:21:50.7400000",
"1": "12",
"2": "Pieter",
"3": "Vanhove",
"4": "Belgium",
"5": "300.00",
"6": "-10000.00",
"7": "2022-12-01 16:21:50.7400000",
"8": "INSERT"
}
]
},
"text/html": [
"<table>",
"<tr><th>CommitTime</th><th>UserName</th><th>MoneylineID</th><th>FirstName</th><th>LastName</th><th>Country</th><th>Bet</th><th>Payout</th><th>BetDateTime</th><th>Operation</th></tr>",
"<tr><td>2022-12-01 13:21:28.5033333</td><td>EUROPE\\pivanho</td><td>12</td><td>Pieter</td><td>Vanhove</td><td>Belgium</td><td>300.00</td><td>-10000.00</td><td>2022-12-01 13:21:28.5000000</td><td>INSERT</td></tr>",
"<tr><th>CommitTime</th><th>MoneylineID</th><th>FirstName</th><th>LastName</th><th>Country</th><th>Bet</th><th>Payout</th><th>BetDateTime</th><th>Operation</th></tr>",
"<tr><td>2022-12-01 16:21:50.7400000</td><td>12</td><td>Pieter</td><td>Vanhove</td><td>Belgium</td><td>300.00</td><td>-10000.00</td><td>2022-12-01 16:21:50.7400000</td><td>INSERT</td></tr>",
"</table>"
]
}
}
],
"execution_count": 5
"execution_count": 4
}
]
}